heybij Privacy Policy

1.1 Registration Data. When you create a heybij account, we collect your full legal name, date of birth, residential address, email address, and mobile phone number. This information is required to open your account, communicate with you, and comply with Know Your Customer (KYC) obligations. Providing false registration data is a breach of our Terms & Conditions.

1.2 Identity Verification Data. To comply with our KYC obligations and process withdrawal requests, heybij may collect copies of government-issued identity documents including your National Identity Card (NID), passport, or driving licence. We may also collect utility bills, bank statements, or other proof-of-address documents. These documents are stored in an encrypted document management system with strict access controls.

1.3 Financial Data. heybij collects records of all deposit and withdrawal transactions on your account, including the payment method used (bKash account number, Nagad account number, Rocket account number, Upay account number, bank account details, or card details), transaction amounts in BDT, and timestamps. We do not store full card numbers — card payments are processed via PCI-DSS-compliant payment processors who handle card data directly.

1.4 Gameplay Data. heybij records all game activity associated with your account, including games played, bet amounts, outcomes, session durations, and wagering history. This data is used for account management, dispute resolution, bonus tracking, and responsible gaming monitoring.

1.5 Technical & Device Data. When you access heybij.net, our servers automatically collect certain technical data including your IP address, browser type and version, operating system, device model, screen resolution, referring URL, and pages visited. This data is used for security monitoring, fraud detection, and platform optimisation.

1.6 Communications Data. If you contact heybij support via email or live chat, we retain a record of that communication including the content of messages and any attachments. This data is used for quality assurance, dispute resolution, and staff training purposes.

Categories of Personal Data Collected

2.1 Account Operation. The primary purpose for which heybij processes your personal data is to operate and maintain your player account. This includes creating and managing your account, processing deposits and withdrawals in BDT, crediting and tracking bonuses, recording game results, and providing 24/7 English-language customer support on Bangladesh Standard Time (BST, UTC+6).

2.2 Identity Verification. heybij uses identity and KYC documentation data to verify that you meet the minimum age requirement of 18 years, that you are who you claim to be, and that funds deposited to your account are legitimately yours. This verification process is a regulatory and operational necessity and cannot be waived.

2.3 Fraud Prevention & Security. Technical and financial data is used continuously to monitor for signs of fraudulent activity, account takeover attempts, money laundering, bonus abuse, and multi-accounting. heybij operates automated risk-scoring systems that flag suspicious patterns for manual review by our compliance team.

2.4 Responsible Gaming. Gameplay data, session data, and deposit history are analysed by heybij's responsible gaming systems to identify players who may be exhibiting signs of problem gambling behaviour. Where such indicators are detected, heybij may proactively reach out to offer responsible gaming tools or to apply temporary account restrictions in accordance with our Responsible Gaming Policy.

2.5 Legal & Regulatory Compliance. heybij is required to retain certain personal data to comply with applicable anti-money laundering (AML) laws, financial record-keeping requirements, and lawful requests from regulatory or law enforcement authorities. We process data for compliance purposes based on legal obligation as our lawful basis.

2.6 Platform Improvement. Aggregated and anonymised technical and gameplay data is used to improve the heybij platform — including optimising page performance, identifying game provider issues, improving the mobile experience, and tailoring the game library to the preferences of our Bangladesh-based player community.

2.7 Marketing Communications. With your consent, heybij may send you promotional emails or SMS notifications regarding new games, bonus offers, BPL cricket season promotions, Eid ul-Fitr and Eid ul-Adha special offers, and Pohela Boishakh promotions. You may withdraw your marketing consent at any time by contacting [email protected] or using the unsubscribe link in any marketing email.

2.8 Lawful Basis Summary. heybij processes your personal data under one of the following lawful bases: (a) performance of the contract between you and heybij (account operation, transactions); (b) compliance with a legal obligation (KYC, AML, record-keeping); (c) legitimate interests of heybij (fraud prevention, security, platform improvement); or (d) your explicit consent (marketing communications).

3.1 What Are Cookies. Cookies are small text files placed on your device when you visit a website. heybij uses cookies to keep you logged in between pages, remember your platform preferences, detect suspicious login attempts from new devices, and measure how different areas of heybij.net are used so we can improve performance.

3.2 Types of Cookies Used by heybij.

3.3 Third-Party Cookies. Game content delivered by providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi may be served from third-party domains and may set their own cookies for game-state management. heybij does not control these cookies and encourages you to review the privacy policies of individual game providers if you have concerns about their cookie practices.

3.4 Managing Cookies. You can control and delete cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to your heybij account and using core platform features. Disabling analytics or functional cookies will not affect your ability to play games or process transactions, but may reduce the quality of your platform experience.

3.5 No Advertising Cookies. heybij does not use Google Ads, Facebook Pixel, TikTok Pixel, or any other advertising network cookie or tracking pixel on heybij.net. Your browsing behaviour on heybij.net is not shared with advertising platforms.

4.1 Payment Processors. To process your deposits and withdrawals in BDT, heybij shares the minimum necessary financial data with our payment processing partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, and the Visa/Mastercard processing networks. These partners receive only the data required to execute the specific transaction and are contractually bound to confidentiality and data security obligations.

4.2 Game Providers. To deliver casino games to your account, heybij shares a player session token and anonymised player ID with game providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Ezugi). Your full name, email address, NID number, and payment details are not shared with game providers. Game providers use the session token solely to serve the game and record the outcome for settlement purposes.

4.3 KYC Verification Partners. heybij may use third-party identity verification services to assist with the automated screening of KYC documents. These services process the document images you submit solely for the purpose of verifying their authenticity and are prohibited from using your data for any other purpose.

4.4 Legal & Regulatory Authorities. heybij may disclose personal data to law enforcement agencies, financial intelligence units, regulatory bodies, or courts when required to do so by applicable law, a valid court order, or a lawful regulatory request. heybij will notify you of any such disclosure where legally permitted to do so.

4.5 Business Transfers. In the event that heybij is involved in a merger, acquisition, restructuring, or sale of all or part of its business assets, your personal data may be transferred to the acquiring entity as part of that transaction. heybij will notify affected players by email before any such transfer takes effect and will ensure that the receiving entity is bound by privacy obligations at least as protective as those in this Privacy Policy.

4.6 No Cross-Border Transfers Without Safeguards. heybij does not transfer your personal data to countries or jurisdictions that do not provide an adequate level of data protection without first implementing appropriate safeguards, such as standard contractual clauses or equivalent data transfer mechanisms.

5.1 Retention Principle. heybij retains your personal data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable law. When data is no longer required, it is securely deleted or anonymised in accordance with our internal data retention schedule.

5.2 Active Account Data. While your heybij account remains open and active, all registration data, gameplay records, transaction history, and communications data associated with your account are retained in full. This data is necessary to operate your account, resolve disputes, and comply with AML record-keeping obligations.

5.3 Post-Closure Retention. Following voluntary account closure or termination of your account by heybij, we retain the following data for the periods specified:

5.4 Self-Excluded Players. Where a player has activated self-exclusion, heybij retains a record of the self-exclusion instruction for the full duration of the self-exclusion period plus three (3) years thereafter. This is necessary to prevent inadvertent re-registration during a self-exclusion period and to demonstrate compliance with our responsible gaming obligations.

5.5 Deletion Requests. Where you exercise your right to erasure (see Section 6 below), heybij will delete or anonymise your personal data subject to the retention obligations described in clause 5.3. Data that is required to be retained under applicable law cannot be deleted on request but will be isolated from active processing systems and accessible only for compliance purposes.

6.1 Right of Access. You have the right to request a copy of the personal data heybij holds about you. This includes your registration data, transaction history, KYC documents on file, gameplay records, and communications history. heybij will provide this data in a structured, commonly used electronic format (CSV or PDF) within 30 days of receiving a valid access request.

6.2 Right to Rectification. If any personal data heybij holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic account information (email address, mobile number, residential address) directly via your account settings dashboard. For corrections to identity or KYC data, please contact [email protected].

6.3 Right to Erasure. You have the right to request deletion of your personal data where: (a) the data is no longer necessary for the purpose for which it was collected; (b) you withdraw consent and there is no other lawful basis for processing; or (c) you object to processing and there are no overriding legitimate grounds. This right is subject to the retention obligations described in Section 5 — data required to be retained under applicable law cannot be deleted.

6.4 Right to Restriction of Processing. You may request that heybij temporarily restrict the processing of your personal data in circumstances where: (a) you contest the accuracy of the data; (b) you believe processing is unlawful but prefer restriction to erasure; or (c) heybij no longer needs the data but you require it for legal claims. During a restriction period, heybij will store the data but not actively process it except to establish, exercise, or defend legal claims.

6.5 Right to Data Portability. Where heybij processes your data on the basis of your consent or for contract performance, you have the right to receive your personal data in a structured, machine-readable format and to request that heybij transmit it directly to another controller where technically feasible.

6.6 Right to Object. You have the right to object to heybij processing your personal data for direct marketing at any time. You may also object to processing based on legitimate interests, in which case heybij will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

6.7 Right to Withdraw Consent. Where heybij processes your data based on your consent (e.g., for marketing communications), you may withdraw that consent at any time by contacting [email protected] or using the unsubscribe mechanism in any marketing email or SMS. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6.8 Complaints. If you believe heybij has not handled your personal data in accordance with this Privacy Policy or applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority in your jurisdiction. heybij encourages you to contact us first at [email protected] so that we can attempt to resolve your concern directly and promptly.

7.1 Technical Safeguards. heybij implements a layered set of technical security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include 256-bit SSL/TLS encryption for all data in transit, AES-256 encryption for sensitive data at rest (including KYC documents and payment method identifiers), firewalled and access-controlled server infrastructure, and regular third-party security penetration testing.

7.2 Access Controls. Access to personal data within heybij's internal systems is restricted on a strict need-to-know basis. Customer support agents have access only to the account data necessary to assist with your specific query. KYC documents are accessible only to trained compliance personnel. Database access is logged and audited. Employees with data access privileges undergo background screening before appointment and regular data protection training thereafter.

7.3 Two-Factor Authentication. heybij's player-facing platform uses OTP-based two-factor authentication for new-device logins, adding an additional layer of protection to your account beyond your username and password. heybij's internal systems also enforce multi-factor authentication for all staff accessing customer data systems.

7.4 Payment Security. heybij does not store full payment card numbers on its own servers. Card payment processing is delegated to PCI-DSS Level 1 certified payment processors. bKash, Nagad, Rocket, and Upay transactions are processed through the official APIs of those providers using tokenised payment references.

7.5 Data Breach Response. In the event of a personal data breach that poses a risk to your rights and freedoms, heybij will notify you without undue delay and in any event within 72 hours of becoming aware of the breach, to the extent that notification is legally required. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures heybij has taken or proposes to take to address it.

7.6 Your Role in Security. heybij's security measures protect the platform and your data at the server level. You also play a critical role in the security of your own account. You must: (a) choose a strong, unique password for your heybij account; (b) never share your password, OTP codes, or session tokens with anyone; (c) log out of your account when using shared or public devices; and (d) notify heybij immediately at [email protected] if you suspect any unauthorised access to your account.

8.1 Data Controller. The data controller responsible for your personal data is heybij, the operator of the online entertainment platform at heybij.net. heybij is responsible for determining the purposes and means of processing your personal data as described in this Privacy Policy.

8.2 Data Protection Officer. heybij has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection law. The DPO can be contacted via the heybij support team at [email protected] with the subject line "Data Protection Officer" or "Data Rights Request". All data rights requests, privacy complaints, and data breach notifications should be directed to this contact.

8.3 Response Timeframes. heybij will acknowledge all privacy-related correspondence within 48 hours of receipt (on Bangladesh Standard Time, BST UTC+6). Substantive responses to data rights requests will be provided within 30 days. Where a request is complex or involves a large volume of data, heybij may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day period.

8.4 Policy Updates. heybij reserves the right to update this Privacy Policy at any time. Where a material change is made — particularly any change that affects the purposes for which we process your data, the third parties with whom we share it, or your privacy rights — heybij will notify you by email to your registered address before the updated policy takes effect. The effective date at the top of this page will be updated to reflect the date of the most recent revision. Your continued use of heybij.net after notification of a policy update constitutes your acceptance of the revised Privacy Policy.

8.5 Applicable Law. This Privacy Policy is governed by and construed in accordance with the laws applicable to heybij's operational jurisdiction. Any dispute arising from this Privacy Policy that cannot be resolved through heybij's internal complaints process shall be referred to the competent courts of the relevant jurisdiction.