Privacy Policy

hay baj collects personal data from you in the following circumstances: when you register an account, when you use the platform's features and services, when you contact our support team, and automatically as you navigate the platform. The categories of data we collect are set out below.

1.1 Registration and Account Data

When you create a hay baj account, we collect the following information that you provide directly:

• Full legal name
• Date of birth (required for age verification — 18+ only)
• Email address
• Username and hashed password
• Country of residence (Bangladesh)
• Mobile phone number (where provided)
• Preferred currency (Bangladeshi Taka, BDT)

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) obligations, we may collect and process the following verification documents and associated data:

• Government-issued photo identification (National ID card, passport, or driving licence — including the document number, expiry date, and photograph)
• Proof of residential address (utility bill, bank statement, or official correspondence)
• Proof of payment method ownership (confirmation linking your bKash, Nagad, Rocket, Upay, or bank account to your registered name)
• Source of funds declarations for high-volume accounts where required by our compliance framework

KYC documents are processed and stored securely in accordance with the retention periods set out in Section 6. They are not used for any purpose other than identity verification and fraud prevention.

1.3 Transaction and Financial Data

When you make deposits or request withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, or any supported Bangladeshi bank (including Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, and Sonali Bank), we record the following transaction data:

• Transaction type (deposit or withdrawal), amount in BDT (৳), and timestamp
• Payment method type and masked account identifier (e.g., last four digits of a card, or the mobile number associated with a bKash account)
• Transaction reference numbers issued by the payment processor
• Account balance before and after each transaction

hay baj does not store full card numbers, CVV codes, or full mobile banking PINs. Payment credentials are tokenised and handled directly by our certified payment processing partners.

1.4 Gameplay and Betting Data

We collect records of your activity on the hay baj platform including:

• Games played, bets placed, wager amounts, and outcomes
• Session duration, login timestamps, and session frequency
• Bonus offers claimed and wagering progress
• Sports betting markets accessed and bet slips generated

This data is used for account management, responsible gaming monitoring, dispute resolution, and the improvement of our product and game offerings.

1.5 Technical and Device Data

When you access hay baj, our servers automatically collect certain technical data, including:

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser version
• Referring URL and pages visited within the platform
• Session identifiers and cookie data (see Section 4)

1.6 Communications Data

If you contact hay baj support by email or live chat, we retain records of those communications, including the content of messages, timestamps, and any attachments submitted. This data is used to resolve your query and to improve our service quality.

hay baj does not sell your personal data to third parties. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

3.1 Payment Processing Partners

To process your deposits and withdrawals, we share necessary transaction data with our payment processing partners. These include mobile financial service providers (bKash, Nagad, Rocket, Upay), card networks (Visa, Mastercard), and Bangladeshi banking partners (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank). Each payment partner receives only the minimum data required to process the specific transaction and is contractually bound to use it for no other purpose.

3.2 Game Software Providers

Games on the hay baj platform are provided by third-party software studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others. These providers may receive session identifiers and anonymised gameplay data to deliver the game experience and to validate game outcomes. They do not receive your full name, contact details, or financial information.

3.3 Identity Verification Services

hay baj may use third-party identity verification services to assist with KYC document review and age verification. These service providers process identity documents under strict confidentiality and data processing agreements and are not permitted to retain or use your documents beyond the scope of the verification task.

3.4 Legal and Regulatory Disclosure

hay baj may disclose personal data to law enforcement agencies, financial intelligence units, or regulatory authorities where we are legally required to do so, or where disclosure is necessary to prevent, detect, or investigate suspected financial crime, fraud, or serious harm. We will notify you of any such disclosure where we are legally permitted to do so.

3.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of hay baj's business assets, player data may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer and of any resulting changes to this Privacy Policy in advance of the transfer taking effect.

hay baj implements a layered security architecture to protect your personal data against unauthorised access, alteration, disclosure, or destruction. The following technical and organisational measures are in place across the platform.

5.1 Technical Safeguards

• TLS/SSL encryption: All data in transit between your device and hay baj servers is encrypted using current TLS standards. Our SSL certificate can be verified in your browser's security indicator.
• Password hashing: Account passwords are stored using industry-standard one-way hashing algorithms. hay baj staff cannot view your password in plain text under any circumstances.
• Tokenised payment data: Full payment credentials (card numbers, mobile banking PINs) are never stored on hay baj servers. Payments are tokenised at the point of entry by our certified payment processor partners.
• Two-factor authentication: Players are encouraged to enable 2FA on their accounts. Support staff are required to use multi-factor authentication to access internal systems.
• Intrusion detection: Our infrastructure is monitored continuously for anomalous access patterns, brute-force attempts, and other indicators of compromise.

5.2 Organisational Safeguards

• Access to player personal data is restricted on a strict need-to-know basis. Support agents can access only the account data necessary to resolve a specific open query.
• All staff with access to personal data undergo regular data protection training and are bound by confidentiality obligations.
• Third-party service providers who process data on behalf of hay baj are subject to data processing agreements that require equivalent security standards.
• Security practices are reviewed periodically and updated in response to emerging threats.

5.3 Data Breach Response

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, hay baj will notify the affected individuals without undue delay. Notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach. Where technically and operationally feasible, notification will be issued within 72 hours of hay baj becoming aware of the breach.