Privacy Policy — heybazi

When you register, verify, deposit, play, or otherwise interact with the heybazi platform, we collect certain categories of personal data. The specific data collected depends on the action you are taking and the services you are accessing. The main categories are set out in the table below.

We do not knowingly collect personal data from individuals under the age of 18. If we discover that data has been collected from a person under 18, that data will be deleted immediately and the associated account will be closed without delay. If you believe a minor has registered on heybazi, please notify us at support@heybazi immediately.

heybazi processes your personal data for clearly defined, legitimate purposes. We do not use your data for any purpose incompatible with the purposes listed below. The primary purposes for which we process your personal data are as follows:

• Account registration and management: Creating, maintaining, and securing your player account; authenticating your identity at login; processing account settings changes and preference updates.
• KYC and age verification: Verifying that you are aged 18 or above and confirming your identity in accordance with our anti-fraud and responsible gaming obligations. This is a mandatory requirement and cannot be waived.
• Payment processing: Processing deposits via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other accepted Bangladeshi payment methods; processing withdrawal requests to your nominated payment account; maintaining financial transaction records for accounting and regulatory purposes.
• Service delivery: Providing access to sports betting markets (including BPL, IPL, T20 World Cup, football, kabaddi), casino games, live dealer tables, slots, Bingo Fishing, Super Keno, and all other Platform services.
• Responsible gaming compliance: Monitoring for indicators of problem gambling; applying deposit limits, session time reminders, and self-exclusion restrictions at your request or where required by our responsible gaming policy.
• Anti-money laundering (AML) monitoring: Detecting and investigating unusual transaction patterns; fulfilling mandatory reporting obligations to relevant authorities where suspicious activity is identified.
• Customer support: Responding to enquiries, complaints, and requests received via live chat and email; maintaining support records for quality assurance and dispute resolution purposes.
• Marketing communications: Sending promotional offers, bonus notifications, tournament announcements, and seasonal promotions (e.g., BPL season offers, Eid cashback, Pohela Boishakh free spins) to players who have opted in to receive such communications. You may withdraw your marketing consent at any time via your account preferences or by contacting support.
• Platform security and fraud prevention: Detecting and preventing cheating, collusion, multi-accounting, bonus abuse, and other prohibited activity; protecting the integrity of the Platform and the fairness of games.
• Analytics and improvement: Analysing anonymised usage patterns to improve Platform performance, game selection, payment flows, and user experience. Individual players are never identified in these analytics.
• Legal and regulatory obligations: Maintaining records as required by applicable law; cooperating with lawful requests from regulatory and law enforcement authorities.

heybazi processes your personal data on the following legal bases, depending on the specific processing activity involved:

• Contract performance: Processing that is necessary for the performance of the player account agreement — including registration, payment processing, game access, and withdrawal handling — is carried out on the basis of contractual necessity. Without this processing, we cannot provide the Platform services.
• Legal obligation: Processing necessary to comply with applicable laws and regulations — including KYC identity verification, AML transaction monitoring, and mandatory data retention — is carried out on the basis of our legal obligations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics is carried out on the basis of our legitimate interests, where those interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications (email, SMS, push notifications) is carried out only on the basis of your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of earlier processing or your ability to continue using the Platform.

heybazi uses cookies and similar tracking technologies to operate the Platform effectively, maintain your session, and understand how the Platform is used. A cookie is a small text file placed on your device by a website. The categories of cookies we use are described below.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent the Platform from functioning correctly. Disabling analytics or marketing cookies will not affect your ability to play games or make transactions.

heybazi does not use tracking technologies to build advertising profiles for sale to third-party advertisers, and we do not participate in cross-site tracking networks that follow you across unrelated websites.

heybazi does not sell, rent, or trade your personal data. We share your data only in the limited circumstances described below, and only to the extent necessary for the specified purpose.

• Payment processors: To process deposits and withdrawals, we share the minimum necessary financial data with our payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank. Each payment partner processes your data under their own privacy policy and applicable banking regulations.
• Game providers: To deliver casino and specialty games, technical game data (session tokens, stake amounts, game results) is shared with approved game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. Game providers receive only the technical data required to run the game and are contractually prohibited from using it for any other purpose.
• Identity verification services: Where automated KYC checks are used, identity document data may be shared with a contracted third-party verification provider for the sole purpose of confirming identity and age.
• Regulatory and law enforcement authorities: heybazi is obligated by applicable AML and fraud prevention laws to report suspicious activity to relevant authorities. We will disclose personal data to regulatory bodies, law enforcement agencies, or courts where required by a valid legal obligation or lawful order.
• Fraud prevention agencies: Where we have reasonable grounds to suspect fraud, multi-accounting, or match-fixing, we may share relevant account data with specialist fraud prevention services to protect the integrity of the Platform.
• Professional advisers: Lawyers, auditors, and accountants engaged by heybazi may access personal data to the extent necessary to provide their professional services, subject to strict confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of heybazi's business assets, player data may be transferred to the acquiring entity. In such an event, players will be notified via their registered email address before their data is transferred and before it becomes subject to a different privacy policy.

heybazi retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulation. The retention periods for the main categories of data are as follows:

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an individual player. Where anonymisation is used rather than deletion, the resulting anonymised data may be retained indefinitely for aggregated statistical purposes.

As a player on the heybazi platform, you have a number of rights in relation to the personal data we hold about you. These rights are described below. To exercise any of these rights, please contact our support team at support@heybazi with the subject line "Data Rights Request". We will respond within 30 days of receiving a valid request.

Please note that certain rights are subject to limitations. For example, the right to erasure does not apply where heybazi is required by law to retain data for a specified period (such as financial transaction records). Where we are unable to fulfil a data rights request in full, we will explain the reason in our response.

heybazi will never charge a fee for processing a data rights request unless the request is manifestly unfounded, repetitive, or excessive. In such cases, we will notify you before applying any charge.

heybazi takes the security of your personal data seriously and has implemented a layered set of technical and organisational security measures designed to protect your data against unauthorised access, accidental loss, destruction, or disclosure.

• Transport encryption: All data transmitted between your device and heybazi is encrypted using 256-bit SSL/TLS, ensuring that data in transit cannot be intercepted by third parties.
• Data at rest encryption: Sensitive personal data stored on heybazi servers is encrypted at rest using AES-256 encryption standards.
• Access controls: Access to personal data is restricted to authorised heybazi personnel and contracted service providers who have a verified operational need. All internal access is logged and audited regularly.
• Two-factor authentication: Players are encouraged to enable SMS OTP two-factor authentication on their accounts. Internal staff access to production systems requires mandatory multi-factor authentication.
• Penetration testing and vulnerability scanning: heybazi's technical infrastructure is subject to periodic independent security assessments to identify and remediate potential vulnerabilities.
• Incident response: heybazi maintains a documented data breach response procedure. In the event of a security incident that poses a risk to player data, affected players will be notified promptly in accordance with applicable notification requirements.
• Staff training: All heybazi staff with access to personal data receive regular data protection and security awareness training.

The heybazi Platform integrates with a number of third-party service providers to deliver its full range of gaming and payment services. Each of these third parties processes data under their own privacy policies and applicable data protection obligations. heybazi conducts due diligence on all third-party partners to ensure that appropriate data protection standards are maintained.

• Game providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi provide certified RNG casino games and live dealer content. These providers receive only technical session data necessary to deliver the game experience.
• Payment providers: bKash, Nagad, Rocket, Upay, and partnered Bangladeshi banks process financial transaction data in accordance with Bangladesh Bank regulations and their own published privacy notices.
• Analytics providers: Where third-party analytics tools are used, data is shared in anonymised or aggregated form only. heybazi does not permit analytics providers to use Platform data for their own advertising or profiling purposes.
• Customer support tools: Our live chat and support ticketing infrastructure may be provided by a contracted third-party platform. Support conversations are stored and processed only for the purposes of resolving your query and maintaining service quality records.

heybazi is not responsible for the privacy practices of external websites or services that may be linked from marketing communications or third-party contexts outside the Platform itself. This Privacy Policy applies solely to data processed by heybazi within the Platform.

heybazi reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. Where a change is material — meaning it substantially affects how we process your personal data or the rights available to you — we will notify you via your registered email address at least 14 days before the change takes effect.

Minor or administrative updates (for example, corrections to typographical errors or clarifications that do not affect your rights) may be implemented without prior notice. The effective date at the top of this page will always reflect the date of the most recent version.

Your continued use of the heybazi Platform following the effective date of any update constitutes your acknowledgement of the revised Privacy Policy. If you do not agree with the updated policy, you should stop using the Platform and contact support@heybazi to close your account. Any Balance in your account at the time of closure will be processed in accordance with the withdrawal procedures in our Terms & Conditions.

The current version of this Privacy Policy was last reviewed and updated on 1 January 2026. Previous versions are available on request by contacting support@heybazi.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way heybazi handles your personal data, please contact our support team using the details below. We are committed to responding to all privacy-related enquiries within 30 days of receipt.

When submitting a data rights request or a privacy complaint, please include your registered email address, a brief description of your request or concern, and — where relevant — the approximate date(s) on which the data processing in question occurred. This will help us locate the relevant records and respond to you accurately and promptly.

If you are dissatisfied with heybazi's response to a privacy enquiry or data rights request, you may seek independent legal advice or refer the matter to an appropriate dispute resolution body in accordance with applicable law. heybazi is committed to resolving all privacy concerns fairly and transparently.

This Privacy Policy was last reviewed on 1 January 2026. Thank you for trusting heybazi with your personal data. We take that trust seriously and remain committed to protecting your privacy at every stage of your gaming experience.