heibaj Privacy Policy
At heibaj, your personal data is handled with care, transparency, and purpose. This Privacy Policy explains exactly what information we collect, why we collect it, how we use and protect it, and the rights you hold as a registered player on our platform.
Our Core Privacy Commitments
The following cards summarise the most important privacy principles that guide how heibaj manages your personal information. The full legal detail for each area is set out in the sections below.
Purpose-Limited Collection
heibaj only collects personal data that is necessary for operating your account, processing payments, preventing fraud, and complying with legal obligations. We do not harvest data for advertising or sell your information to third parties for marketing purposes.
Encrypted Data Storage
All personal data stored by heibaj is protected using industry-standard AES-256 encryption at rest. Data in transit between your device and the heibaj platform is secured via TLS 1.3 SSL encryption, protecting it from interception or tampering.
No Third-Party Data Sales
heibaj does not sell, rent, or trade your personal data with advertisers, data brokers, or marketing agencies. The only third parties who receive your data are those directly involved in delivering our services — such as payment processors and game providers.
Your Rights, Respected
As a heibaj player, you have the right to access, correct, export, or request deletion of your personal data at any time. You may also object to certain types of data processing. All requests are handled within 5 business days by our support team.
Transparent Cookie Use
heibaj uses cookies and similar tracking technologies to deliver a smooth, personalised experience on our platform. Our cookie policy is fully disclosed in this document. You can manage your cookie preferences at any time through your browser settings.
No Data from Minors
heibaj strictly prohibits registration by anyone under 18 years of age. We do not knowingly collect personal data from minors. If we identify that a registered account belongs to a person under 18, the account is closed and all associated data handled in accordance with our retention policy.
Information We Collect
heibaj collects personal information from you in three primary ways: information you provide directly, information generated automatically through your use of the platform, and information received from trusted third-party partners involved in delivering our services.
How We Use Your Information
heibaj uses the personal data we collect for specific, defined purposes only. We do not use your data in ways that are incompatible with the purpose for which it was originally collected. The primary purposes for which heibaj processes personal data are set out below.
- Account creation and management: Your registration data is used to create and maintain your heibaj account, authenticate your identity at login, and manage account settings and preferences.
- Payment processing: Financial data is used to process deposits and withdrawals via bKash, Nagad, Rocket, Upay, bank transfer, and card networks. Transaction records are maintained for financial reconciliation and regulatory compliance purposes.
- Identity verification (KYC): KYC documents are used to verify your identity and age, confirm that you meet the 18+ eligibility requirement, and satisfy anti-money laundering obligations. KYC data is processed via our verified identity verification partner and is not used for any other purpose.
- Platform personalisation: Behavioural and gaming activity data is used to personalise your heibaj experience — for example, displaying recently played games, recommending relevant promotions, and tailoring the layout of your account dashboard.
- Fraud prevention and security: Technical device data and behavioural signals are used to detect and prevent fraud, account takeover, bonus abuse, and other security threats. IP address monitoring is used to identify suspicious login patterns and enforce geographic access controls.
- Responsible gaming monitoring: Gaming activity data — including session duration, bet frequency, and deposit volume — is analysed to identify patterns consistent with problem gambling. Where such patterns are detected, heibaj may proactively reach out to the player with responsible gaming resources.
- Customer support: Communication records are used to manage and respond to support queries, investigate complaints, and improve the quality of our customer service processes.
- Legal and regulatory compliance: heibaj processes and retains certain data to satisfy obligations under applicable anti-money laundering, know-your-customer, and financial record-keeping requirements. This includes transaction records and KYC documentation.
- Platform improvement: Aggregated and anonymised usage data is used to understand how players interact with heibaj, identify areas for platform improvement, and test new features. This data is never linked back to individual player identities in any reporting or analysis.
Sharing and Disclosure of Data
heibaj does not sell your personal data to any third party under any circumstances. We share personal data with external parties only where it is strictly necessary to deliver our services, meet legal obligations, or protect the security and integrity of the platform. The categories of third parties who may receive your data, and the basis for that sharing, are described below.
- Payment service providers: To process your deposits and withdrawals, heibaj shares relevant financial information with payment processors including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and card networks (Visa, Mastercard). These providers are contractually bound to use your data solely for payment processing purposes.
- Identity verification providers: heibaj uses a certified third-party KYC service to verify identity documents and perform liveness checks. The KYC provider receives your uploaded documents and verification images under a strict data processing agreement and is prohibited from using your data for any independent purpose.
- Game technology providers: To deliver casino and sports betting products, heibaj shares limited session data (such as player session tokens and bet outcomes) with licensed game providers including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi. This data is necessary for game functionality and RNG auditing. Game providers do not receive your registration details or payment information.
- Fraud and security vendors: heibaj may share device fingerprint and behavioural data with specialist fraud detection services to identify suspicious activity and protect the platform and its players from financial crime.
- Legal and regulatory authorities: heibaj is required by law to disclose certain player information — including transaction records and identity documents — to relevant authorities upon receipt of a valid legal request. Such disclosures are made only as required by applicable law and are logged for compliance audit purposes.
- Business transfers: In the event of a merger, acquisition, or sale of all or part of the heibaj business, player data may be transferred to the acquiring entity as part of that transaction. Players will be notified via email before their data is transferred to a new controller, and the acquiring entity will be required to honour the commitments made in this Privacy Policy.
Data Security Measures
heibaj takes the security of your personal data seriously and implements a layered approach to information security that covers technical, procedural, and organisational controls. The following measures are in place to protect your data from unauthorised access, disclosure, alteration, or destruction.
- TLS 1.3 encryption in transit: All data transmitted between your device and the heibaj platform is encrypted using TLS 1.3, the current industry standard for secure web communications. This prevents interception of your data during transmission.
- AES-256 encryption at rest: Personal data stored on heibaj servers — including identity documents, transaction records, and account details — is encrypted using AES-256 encryption. Encryption keys are managed separately from the data they protect.
- Password hashing: Account passwords are never stored in plain text. heibaj uses bcrypt hashing with a unique salt per password, meaning that even in the event of a data breach, your password cannot be recovered from stored data.
- Access controls: Access to personal data within heibaj's systems is restricted on a strict need-to-know basis. Internal staff access to player data is role-based, logged, and subject to regular review. No staff member has unrestricted access to all player data.
- Two-factor authentication (2FA): heibaj offers two-factor authentication on player accounts as an additional layer of login security. Players are encouraged to enable 2FA from their account security settings.
- Penetration testing and security audits: heibaj conducts regular security assessments including external penetration testing and internal vulnerability scans to identify and remediate potential security weaknesses before they can be exploited.
- Data breach response: In the event of a personal data breach that poses a risk to player rights and freedoms, heibaj will notify affected players via the email address registered on their account as promptly as possible following discovery and internal assessment of the breach. Notification will include the nature of the breach, the data affected, and the steps heibaj is taking in response.
Data Retention and Deletion
heibaj retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to maintain your active account, and to comply with applicable legal, regulatory, and financial record-keeping obligations. The following retention periods apply to the main categories of data heibaj holds.
When personal data reaches the end of its applicable retention period and is no longer required for any legitimate ongoing purpose, heibaj permanently and securely deletes it from active systems. Deletion processes are documented and audited internally. Backups containing personal data are purged on a rolling schedule consistent with the above retention periods.
If you request deletion of your personal data (see Section 7 — Your Privacy Rights), heibaj will delete or anonymise all data that is not subject to a mandatory legal or regulatory retention obligation. Where data must be retained for compliance reasons, it will be isolated from active processing systems and held solely to fulfil the relevant legal obligation.
Your Privacy Rights
As a heibaj player, you hold a number of rights in relation to the personal data we hold about you. These rights can be exercised at any time by contacting our support team at [email protected]. heibaj will respond to all valid privacy rights requests within 5 business days.
Right of Access
You may request a copy of all personal data heibaj holds about you. We will provide a structured, readable summary of your data within 5 business days of receiving your request.
Right to Rectification
If any personal data heibaj holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Contact support with the specific data you want updated and supporting documentation where applicable.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to heibaj's legal retention obligations. Data required by law to be retained will not be deleted but will be isolated.
Right to Restrict Processing
You may request that heibaj restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested or while an objection to processing is being evaluated.
Right to Data Portability
You may request a copy of the personal data you have provided to heibaj in a structured, machine-readable format (JSON or CSV). This right applies to data processed on the basis of your consent or a contract with you.
Right to Object
You may object to heibaj processing your personal data for direct marketing, profiling, or other legitimate interest-based purposes. Where an objection is upheld, processing for that purpose will cease immediately.
Changes to This Privacy Policy
heibaj may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. When we make changes, we will update the "Last updated" date displayed at the top of this document and in the page hero section above.
Where changes to this Privacy Policy are material — meaning they significantly affect how we collect, use, or share your personal data — heibaj will notify registered players via the email address associated with their account at least 14 days before the updated policy takes effect. Your continued use of the heibaj platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms.
For non-material changes (such as clarifications, corrections, or formatting improvements that do not alter the substance of our data practices), the updated policy will take effect immediately upon publication at heibaj.com/privacy-policy. We encourage you to review this page periodically to stay informed about how heibaj protects your data.
Previous versions of this Privacy Policy are available upon request by contacting [email protected] with the subject line "Previous Privacy Policy Version".
📬 Contact Us About Privacy
For any questions, concerns, or requests relating to this Privacy Policy or the personal data heibaj holds about you, please contact our dedicated privacy support team:
📧 Email: [email protected]
Support hours: 9 AM – 11 PM Bangladesh Standard Time (BST, UTC+6), 7 days a week. For urgent data security concerns, include "URGENT PRIVACY" in your email subject line.
🔗 Related Policies
This Privacy Policy is read alongside the following heibaj policy documents, which together form the complete agreement governing your use of the platform:
- Terms & Conditions — platform rules and player obligations
- Responsible Gaming Policy — tools, limits, and self-exclusion
- FAQ — common questions about accounts and payments
- About Us — who we are and how heibaj operates
Ready to Play on a Platform You Can Trust?
heibaj is built with your privacy and security at the centre. Explore our games, read our FAQ for quick answers, or head to heibaj Casino to start your session today.