Privacy Policy — How haybaj Protects Your Data

For the purposes of this Privacy Policy, the data controller responsible for your personal information is haybaj ("haybaj", "we", "us", "our"). haybaj operates the online casino and sports betting platform accessible at haybaj.com and is responsible for determining the purposes and means by which your personal data is processed.

All data protection enquiries, access requests, and complaints should be directed to haybaj's dedicated privacy contact at [email protected]. Please include "Privacy Request" in the subject line of your email so that your message is routed to the appropriate team member without delay. haybaj aims to acknowledge all privacy-related emails within two (2) business days.

This Privacy Policy applies to all personal data collected through:

• The haybaj.com website and any subdomains operated by haybaj
• The haybaj account registration, login, and verification processes
• All deposits, withdrawals, and payment transactions processed through the platform
• haybaj's customer support communications, including email and live chat
• Participation in promotions, tournaments, or loyalty programmes offered by haybaj
• Any cookies or tracking technologies active on haybaj.com, as detailed in Section 4

haybaj processes your personal data only where there is a legitimate and defined basis for doing so. The following describes each processing activity, the data categories involved, and the legal basis on which the processing rests.

Account Management and Service Delivery: We use your registration data to create and maintain your haybaj account, authenticate your login sessions, process your bets and casino game rounds, credit winnings to your BDT wallet, and communicate important account notifications such as password resets, security alerts, and policy updates. This processing is necessary to perform the contract between haybaj and you as an account holder.

Identity Verification and Anti-Money Laundering (AML) Compliance: KYC document data is processed to confirm that you are who you say you are, that you meet the 18+ age requirement, and that your account activity does not present indicators of money laundering or financial fraud. This processing is required to comply with legal obligations applicable to financial services platforms operating in Bangladesh and internationally.

Payment Processing: Financial transaction data — including your bKash, Nagad, Rocket, or Upay wallet identifiers and transaction records — is processed to execute your deposit and withdrawal instructions and to maintain accurate account balance records. haybaj does not store full card numbers. Payment data is processed in compliance with applicable financial data standards.

Responsible Gaming Monitoring: Gameplay data and session data are analysed to identify patterns that may indicate problem gambling behaviour, such as rapid escalation of bet sizes, extended uninterrupted sessions, or repeated failed withdrawal requests. Where such patterns are identified, haybaj may reach out proactively to offer responsible gaming tools. This processing is carried out in the legitimate interest of player welfare and platform integrity.

Fraud Detection and Platform Security: Technical data including IP addresses, device fingerprints, and login patterns are analysed to detect and prevent account takeover attempts, bonus abuse, multi-accounting, and other fraudulent behaviours. This processing is carried out in haybaj's legitimate interest in maintaining a fair and secure platform for all players.

Marketing Communications: Where you have explicitly opted in to receive promotional communications, haybaj may send you emails or SMS messages about new games, seasonal promotions (such as Eid or BPL cricket season offers), deposit bonuses, and other platform news. You may withdraw your marketing consent at any time by updating your notification preferences in Account Settings or by emailing [email protected]. Withdrawal of marketing consent does not affect service communications, which are sent regardless of marketing preferences.

haybaj does not sell, rent, or trade your personal data. We share personal data with third parties only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

Game Technology Providers: haybaj's casino and sports betting products are powered by certified international game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game supplied by one of these providers, limited technical data (such as a pseudonymous session token and bet amount) is transmitted to the provider's servers to run the game round. These providers are contractually prohibited from using this data for any purpose other than game delivery and are required to maintain data security standards equivalent to those applied by haybaj.

Payment Service Providers: To process your deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, haybaj shares the minimum necessary transaction data with each payment service provider. This typically includes the transaction amount, your registered mobile number or payment identifier, and a transaction reference. Payment providers are bound by their own regulatory data protection obligations and their privacy practices are governed by their respective policies.

Identity Verification and KYC Partners: haybaj may use third-party identity verification services to assist with KYC document review and age verification. These partners process your submitted identity documents under strict data processing agreements and are not permitted to retain your documents after the verification process is complete.

Legal and Regulatory Disclosure: haybaj may disclose personal data to law enforcement agencies, financial intelligence units, regulatory authorities, or courts where required to do so by applicable law, a court order, or a valid legal process. haybaj will notify affected account holders of such disclosures where legally permitted to do so.

Business Transfers: In the event that haybaj undergoes a corporate restructuring, merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to this Privacy Policy that result from it, no later than thirty (30) days before the transfer takes effect.

As a haybaj account holder, you hold the following rights in relation to your personal data. To exercise any of these rights, send a written request to [email protected] with "Privacy Request" in the subject line. haybaj will respond within thirty (30) days of receiving a verified request. We may ask you to confirm your identity before processing a request to protect against unauthorised access to another person's data.

• Right of Access (Subject Access Request): You have the right to request a copy of all personal data haybaj holds about you, together with information about how it is used, where it is stored, and with whom it has been shared. haybaj will provide this information in a structured, commonly used, machine-readable format.
• Right to Rectification: If any personal data haybaj holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic account information (such as your email address or mobile number) directly through Account Settings. For corrections to KYC data, please contact support.
• Right to Erasure ("Right to be Forgotten"): You may request that haybaj delete your personal data. haybaj will honour erasure requests where there is no overriding legal obligation to retain the data. Where retention is legally required (for example, AML transaction records), haybaj will explain which data cannot be erased and why, and will delete all other data that is not subject to a retention obligation.
• Right to Restrict Processing: You may request that haybaj temporarily restrict the processing of your personal data — for example, while a dispute about data accuracy is being resolved — rather than deleting it outright.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) and to transmit it to another service provider. This right applies to data you have provided directly to haybaj and that is processed on the basis of your consent or a contract.
• Right to Object to Processing: You have the right to object to haybaj processing your personal data for direct marketing purposes. You may also object to processing carried out on the basis of haybaj's legitimate interests, in which case haybaj must cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where haybaj processes your data on the basis of your consent (principally for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.