Privacy Policy —
hebaje Online Gaming

1. Introduction

This Privacy Policy ("Policy") describes how hebaje ("we", "us", "our", or "the Company"), operator of the online gaming platform available at https://hebaje.club (the "Platform"), collects, uses, stores, shares, and protects the personal data of individuals who visit, register on, or otherwise interact with the Platform.

hebaje is Bangladesh's trusted online gaming destination, serving adult players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and beyond. In delivering our services — including cricket betting, live casino, slots, and related features — we necessarily process certain personal information. We take that responsibility seriously.

This Policy applies to all personal data we process in connection with the Platform, including data collected through the website, our customer support channels, payment processing, and any other service interactions. By registering an account or using the Platform, you acknowledge that you have read and understood this Policy.

This Policy should be read alongside the hebaje Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2. Personal Data We Collect

hebaje collects the following categories of personal data in connection with operating the Platform:

2.1 Identity Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (used to verify you are aged 18 or above)
• Nationality and country of residence
• Government-issued identification number (National ID, passport number, or driving licence number)

2.2 Contact Data

• Email address
• Mobile phone number
• Residential or correspondence address

2.3 Account & Authentication Data

• Username chosen at registration
• Encrypted password (never stored in plain text)
• Security questions and answers (where applicable)
• Account preferences and communication settings

2.4 Financial Data

• bKash, Nagad, Rocket, or Upay mobile wallet account identifiers associated with your deposits and withdrawals
• Bank account details (where bank transfer is used)
• Transaction history, including deposit amounts, withdrawal amounts, dates, and payment method used
• Bonus and promotional credit activity

2.5 Technical & Usage Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser information
• Session timestamps, duration, and activity logs
• Pages visited, games played, bets placed, and features used within the Platform
• Referral source (how you arrived at the Platform)

2.6 Communications Data

• Records of correspondence with hebaje customer support, including live chat transcripts and email exchanges
• Feedback, complaints, and dispute records

3. How We Collect Your Data

hebaje collects personal data through the following means:

• Direct provision by you: When you register an account, complete identity verification, make a deposit or withdrawal, contact customer support, or respond to a survey or promotion.
• Automated collection: Through cookies, server logs, and similar technologies when you browse or interact with the Platform. See Section 9 (Cookies) for full details.
• Third-party payment providers: When you process a transaction via bKash, Nagad, Rocket, Upay, or a bank transfer, the relevant payment provider may share transaction confirmation data with hebaje.
• Identity verification services: Where third-party KYC (Know Your Customer) service providers are used to verify documents submitted during the account verification process.
• Fraud prevention and security partners: Services used to detect suspicious activity, bot traffic, or account compromise attempts.

4. How We Use Your Personal Data

hebaje uses the personal data we collect for the following purposes:

Purpose	Data Categories Used
Creating and managing your player account	Identity, Contact, Account & Authentication
Verifying your age and identity (KYC)	Identity, Contact, Financial
Processing deposits and withdrawals	Financial, Identity
Providing customer support	Identity, Contact, Communications, Account
Delivering bonuses and promotional offers	Account, Financial, Usage
Preventing fraud and money laundering	Identity, Financial, Technical & Usage
Ensuring platform security and integrity	Technical & Usage, Account
Responsible gaming monitoring and intervention	Account, Financial, Usage
Sending service notifications (e.g., deposit confirmations)	Contact, Account
Sending marketing communications (with consent)	Contact, Usage
Improving Platform performance and user experience	Technical & Usage (aggregated/anonymised)
Complying with legal and regulatory obligations	Identity, Financial, Communications

5. Legal Bases for Processing

hebaje processes personal data only where a valid legal basis exists. The primary legal bases we rely upon are:

• Contractual necessity: Processing required to perform the contract between you and hebaje — including account creation, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) obligations, age verification requirements, and fraud prevention regulations.
• Legitimate interests: Processing necessary for hebaje's legitimate business interests, such as preventing fraud, maintaining platform security, and improving service quality — provided these interests are not overridden by your rights and freedoms.
• Consent: Where hebaje relies on your consent (for example, to send marketing emails), you have the right to withdraw that consent at any time by contacting [email protected] or updating your account notification preferences.

6. Sharing Your Personal Data

hebaje does not sell, rent, or trade your personal data. We may share your data with the following categories of recipients only to the extent necessary to fulfil the purposes described in this Policy:

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and partner banks — to process your financial transactions.
• Identity verification (KYC) providers: Third-party services used to verify identity documents submitted during account verification.
• Fraud prevention and security services: Services that assist hebaje in detecting, preventing, and investigating fraudulent activity or security threats.
• IT infrastructure and hosting providers: Companies that provide server, cloud storage, or platform hosting services to hebaje under strict data processing agreements.
• Customer support technology providers: Live chat and helpdesk software providers that process communications data on hebaje's behalf.
• Legal and regulatory authorities: Where required by law, court order, or regulatory instruction to disclose personal data to government bodies, law enforcement, or financial intelligence units.

All third-party service providers who process personal data on behalf of hebaje are required to handle that data in accordance with applicable privacy standards and are prohibited from using it for their own purposes.

7. Data Retention

hebaje retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active account data: Retained for the lifetime of your account and for a period of five (5) years following account closure, unless a longer period is required by law.
• Financial transaction records: Retained for a minimum of seven (7) years from the date of the transaction, in compliance with anti-money laundering and financial record-keeping obligations.
• Identity verification documents: Retained for a minimum of five (5) years following the completion of the verification process or account closure, whichever is later.
• Customer support communications: Retained for three (3) years from the date of the interaction, unless the subject matter relates to an ongoing dispute or legal proceeding.
• Marketing consent records: Retained until you withdraw consent, plus a reasonable period thereafter as evidence of prior consent.

When personal data is no longer required and no legal obligation compels its retention, hebaje will securely delete or anonymise it in a manner that prevents recovery or reconstruction.

8. Security Measures

hebaje implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform
• Encrypted password storage — passwords are hashed using industry-standard algorithms and never stored in plain text
• Access controls — internal access to personal data is restricted to authorised personnel whose roles require it, enforced through role-based access management
• Network security monitoring — continuous monitoring for suspicious traffic, intrusion attempts, and anomalous activity
• Regular security reviews — periodic assessments of infrastructure and application security
• Data breach response procedures — documented incident response plans to contain and address any data security incidents promptly

Despite these measures, no method of electronic transmission or storage is completely secure. hebaje cannot guarantee absolute security, but we are committed to maintaining appropriate safeguards and responding swiftly to any confirmed security incident affecting your data.

You also play a role in keeping your account secure. You should use a strong, unique password for your hebaje account, never share your login credentials with others, and contact us immediately at [email protected] if you suspect unauthorised access.

9. Cookies and Similar Technologies

hebaje uses cookies and similar tracking technologies (such as web beacons and pixel tags) to operate and improve the Platform. Cookies are small text files stored on your device that enable us to recognise your browser, remember your preferences, and analyse Platform usage.

9.1 Types of Cookies We Use

• Strictly necessary cookies: Essential for the Platform to function. These include session cookies that keep you logged in during an active session. These cannot be disabled.
• Functional cookies: Remember your account preferences, language settings, and other personalisation choices to improve your experience.
• Analytics cookies: Collect aggregated, anonymised information about how users interact with the Platform, enabling hebaje to identify popular features, diagnose technical issues, and improve overall performance.
• Security cookies: Used to detect and prevent fraudulent activity, bot traffic, and account takeover attempts.

9.2 Managing Cookies

You can control non-essential cookies through your browser settings. Most browsers allow you to block or delete cookies; however, disabling strictly necessary cookies will prevent the Platform from functioning correctly. For guidance on managing cookies in your specific browser, please refer to your browser's help documentation.

10. Your Data Rights

As a player on the hebaje Platform, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data hebaje holds about you.
• Right to rectification: You may request that inaccurate or incomplete personal data be corrected.
• Right to erasure: In certain circumstances, you may request that your personal data be deleted. Note that legal obligations (such as AML record-keeping requirements) may prevent full erasure in some cases.
• Right to restrict processing: You may request that hebaje limits how it uses your data while a complaint or correction request is being resolved.
• Right to data portability: Where processing is based on your consent or a contract, you may request that your data be provided to you in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests, including profiling for marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact hebaje at [email protected]. We will acknowledge your request within 48 hours and aim to respond fully within 30 calendar days. In complex cases, we may extend this period by a further 30 days; if so, we will notify you of the extension and the reason.

11. Minors and Under-18 Protection

The hebaje Platform is strictly intended for adults aged 18 years and above. hebaje does not knowingly collect, store, or process personal data belonging to persons under the age of 18. Age verification is conducted as part of the account registration and KYC process.

If hebaje becomes aware that personal data has been collected from a person under the age of 18, that data will be deleted promptly, the account will be closed, and any funds associated with the account will be returned to the originating payment method after investigation.

Parents or guardians who believe a minor may have registered on the Platform are encouraged to contact us immediately at [email protected].

12. International Data Transfers

hebaje primarily serves players in Bangladesh and processes data within systems located in the Asia-Pacific region. In some circumstances, personal data may be processed by third-party service providers (such as cloud hosting or identity verification providers) whose systems are located outside Bangladesh.

Where such transfers occur, hebaje takes steps to ensure that appropriate safeguards are in place, including contractual data processing agreements that require recipient organisations to apply data protection standards consistent with those described in this Policy.

13. Changes to This Privacy Policy

hebaje reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform features. When material changes are made, we will post a notice on the Platform and update the "Last Updated" date shown at the top of this document.

Where the changes are significant, we will endeavour to notify registered players directly via their account email address. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you should stop using the Platform and may request account closure in accordance with the Terms & Conditions.

14. Contact Us — Privacy Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way hebaje handles your personal data, please contact our support team using the details below:

• Email: [email protected]
• Live Chat: Available 24/7 via the Platform
• Response Time: Live Chat: immediate · Email: 4–12 hours
• Operating Hours: 24 hours a day, 7 days a week (BST, UTC+6)

For requests relating to your data rights (access, rectification, erasure, portability, or objection), please include your registered username and a clear description of your request in your email to help us process it efficiently.