hebajje Privacy Policy — How We Handle Your Data

Information We Collect

hebajje collects personal data from you in three principal ways: information you provide directly during registration and subsequent use of the platform; information generated automatically when you use our services; and information we may receive from authorised third-party verification or payment partners. We collect only the minimum data necessary to operate the platform safely, legally, and effectively for Bangladeshi players.

1.1 Data You Provide Directly

When you register for a hebajje account or interact with our support team, you may provide the following categories of personal information:

• Full legal name (as it appears on your government-issued ID).
• Date of birth (to verify that you meet the 18+ age requirement).
• Residential address in Bangladesh (district, city, postcode).
• Email address (used for account communications and support).
• Mobile phone number (used for account security and payment verification).
• Copies of identity documents submitted for KYC verification (e.g., National ID card, passport).
• Payment method identifiers associated with bKash, Nagad, Rocket, Upay, or bank accounts used to deposit or withdraw funds.
• Any information voluntarily provided when communicating with our support team via email.

1.2 Data Generated Automatically

When you access and use the hebajje platform, certain technical and behavioural data is generated and recorded automatically by our systems. This data is essential for platform security, fraud prevention, and service quality:

• IP address and approximate geographic location derived from it.
• Device type, operating system, browser version, and screen resolution.
• Session timestamps, login history, and session duration.
• Pages visited, games played, bets placed, and wagering activity logs.
• Transaction records including deposit amounts, withdrawal requests, and bonus redemptions (denominated in Bangladeshi Taka ৳).
• Cookie identifiers and local storage data — see the Cookies section for full details.

1.3 Data from Third Parties

In certain circumstances, hebajje may receive data about you from trusted third-party sources in order to fulfil its legal obligations or verify your identity. This includes identity verification responses from KYC service providers, fraud screening signals from payment processors, and — where legally required — data from financial compliance authorities. hebajje does not purchase personal data from third-party data brokers.

How We Use Your Data

hebajje uses the personal data it collects strictly for the purposes described in this Privacy Policy. We do not use your data in ways that are incompatible with the purposes for which it was originally collected. The primary purposes for which hebajje processes personal data are set out below.

hebajje will never use your personal data for purposes not listed above without first obtaining your explicit consent or establishing a different lawful basis for processing. If you receive a communication from hebajje that you did not opt into, please contact [email protected] immediately.

Data Sharing & Disclosure

hebajje does not sell, rent, or trade your personal data. We share your information only in the limited circumstances described below, and always with appropriate contractual and technical safeguards in place to protect your data.

3.1 Authorised Service Providers

hebajje engages carefully vetted third-party service providers to support certain platform operations. These providers act as data processors on our behalf and are contractually prohibited from using your data for any purpose beyond the specific service they provide to us. Categories of authorised processors include:

• Payment processing partners (bKash, Nagad, Rocket, Upay, bank gateway providers) — receive only the transaction data necessary to process your payment.
• KYC and identity verification providers — receive name, date of birth, and document images solely to perform verification.
• Cloud infrastructure and hosting providers — store encrypted platform data under strict access controls.
• Game software studios (Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, Spribe) — receive only the session token and stake data required to run a game round. Studios do not receive your full profile data.
• Email delivery providers — receive your email address and message content solely to transmit account and support communications.

3.2 Legal and Regulatory Disclosure

hebajje may be required by law to disclose your personal data to regulatory authorities, law enforcement agencies, or courts of competent jurisdiction. In such cases, hebajje will disclose only the minimum data required to comply with the lawful request and, where legally permissible, will notify you that a disclosure has been made.

3.3 Business Transfers

In the event that hebajje undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, your personal data may be transferred to the successor entity as part of that transaction. In such circumstances, hebajje will provide reasonable advance notice to registered players and will ensure that the successor entity is contractually bound by the same data protection standards set out in this Privacy Policy.

Cookies & Tracking

hebajje uses cookies and similar browser storage technologies to operate the platform correctly, maintain your session state, and collect anonymised analytics data that helps us improve user experience for Bangladeshi players. We do not use cookies for cross-site behavioural advertising.

4.1 Cookie Categories

4.2 Managing Cookies

You may manage or delete cookies at any time through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging into your hebajje account and using the platform. Disabling functional or analytics cookies will not affect your ability to bet, deposit, or withdraw. Specific opt-out controls for analytics cookies are available in the privacy section of your account dashboard. Most modern browsers also allow you to block third-party cookies globally without affecting first-party session cookies.

Data Security Measures

hebajje takes the security of your personal data seriously and has implemented a layered set of technical and organisational safeguards designed to protect your information against unauthorised access, accidental loss, alteration, or disclosure.

• Transport Layer Security (TLS): All data transmitted between your browser or device and the hebajje platform is encrypted in transit using TLS 1.2 or higher. Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Data Encryption at Rest: Sensitive personal data fields — including identity document images, date of birth, and payment method identifiers — are encrypted at rest using AES-256 encryption on hebajje servers.
• Access Controls: Access to production systems and personal data is restricted to authorised hebajje personnel with a legitimate operational need. Access rights are reviewed regularly and revoked immediately upon termination of employment or contract.
• Intrusion Detection: hebajje's infrastructure is monitored continuously for anomalous activity, unauthorised access attempts, and security events. Automated alerting systems are in place around the clock.
• Account Security Features: Players are encouraged to use a strong, unique password for their hebajje account. Account activity notifications are sent via email for significant events such as login from a new device or a withdrawal request.
• Incident Response: In the event of a data breach that poses a risk to players, hebajje will notify affected individuals as promptly as practicable, explaining the nature of the incident, the data involved, and the steps taken to mitigate harm.

Data Retention

hebajje retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected or to comply with applicable legal, regulatory, and financial record-keeping obligations. The table below summarises our standard retention periods by data category.

When retention periods expire, personal data is securely deleted or irreversibly anonymised in accordance with our internal data destruction procedures. If you request early deletion of your personal data, hebajje will honour that request to the extent permitted by law — noting that data subject to financial compliance obligations cannot be deleted before the mandatory retention period has elapsed.

Your Privacy Rights

hebajje respects your rights over your personal data. Regardless of where you are located in Bangladesh — whether in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar — you have the right to exercise any of the following data rights by contacting our support team at [email protected].

• Right of Access: You may request a copy of all personal data we hold about you. We will provide this in a structured, commonly used format within 30 days of receiving your request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You may update basic account details directly in your account dashboard at any time.
• Right to Erasure: You may request that we delete your personal data. We will honour this request where no overriding legal obligation requires us to retain the data. Mandatory financial records cannot be deleted early.
• Right to Restrict Processing: You may ask us to temporarily restrict processing of your data while a correction or erasure request is being evaluated.
• Right to Data Portability: Where processing is based on your consent or on a contract with you, you may request that we provide your data in a machine-readable format suitable for transfer to another service provider.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Object: You may object to processing carried out on the basis of legitimate interest, including profiling. hebajje will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.

Policy Updates & Contact

hebajje reserves the right to update this Privacy Policy at any time. When we make material changes — such as introducing a new category of data collection or a new third-party sharing arrangement — we will notify registered players by email to the address on file at least 14 days before the change takes effect. For minor editorial updates that do not affect your rights or the way your data is processed, the revised policy will take effect immediately upon publication at hebajje.net/privacy-policy.

The date at the top of this document reflects the date on which the current version became effective. We encourage you to review this Privacy Policy periodically to stay informed about how hebajje protects your data. Continued use of the platform following notification of a material change constitutes your acceptance of the revised policy.

Contact the hebajje Privacy Team

If you have any questions, concerns, or requests relating to this Privacy Policy or the way hebajje handles your personal data, please contact our team in English. We are available 24 hours a day, 7 days a week, and aim to acknowledge all privacy-related enquiries within 24 hours Bangladesh Standard Time.