Privacy Policy —
How heybali Protects Your Data

When you register and use the heybali platform, we collect personal data across several categories. The table below summarises the types of data collected, the source of that data, and the lawful basis on which we process it.

We do not knowingly collect personal data from individuals under the age of 18. If we discover that data has been collected from a minor, it will be deleted immediately and the associated account will be closed.

heybali uses your personal data for a defined set of purposes, each of which is grounded in a legitimate legal basis — either the performance of your account contract, compliance with a legal obligation, your explicit consent, or our legitimate business interest where it does not override your fundamental rights.

• Account Management: To create, maintain, and operate your player account, including verifying your identity at registration and during KYC checks, resetting passwords, and managing account preferences.
• Payment Processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported Bangladeshi banks. Financial data is shared with payment processors solely to complete transactions you have initiated.
• Fraud Prevention & Security: To detect, investigate, and prevent fraud, money laundering, account takeover, and other forms of platform abuse. This includes automated risk scoring of transactions and logins.
• Responsible Gaming: To monitor for signs of problem gambling behaviour — such as sudden increases in deposit frequency or session duration — and to enforce self-exclusion periods, deposit limits, and time-out requests set by the player.
• Customer Support: To respond to enquiries, investigate complaints, and improve the quality of support interactions. Support communications may be reviewed for quality assurance purposes.
• Legal & Regulatory Compliance: To fulfil our obligations under applicable Bangladeshi law and any lawful request from a competent authority, including financial intelligence units and law enforcement agencies.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates by email or SMS — but only where you have provided consent. You may withdraw consent at any time from within your account settings.
• Platform Improvement: To analyse aggregated, anonymised usage patterns to improve game selection, website performance, and the overall player experience on heybali.

heybali does not sell or rent your personal data to any third party. We share your data only in the specific, limited circumstances described below, and only to the extent necessary for the stated purpose.

• Payment Service Providers: Financial data (account numbers, transaction amounts) is shared with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, and Sonali Bank solely to execute deposit and withdrawal transactions initiated by you. Each provider is subject to its own privacy and security obligations under Bangladeshi financial regulations.
• Game Providers: When you launch a game, your player session token and account balance are passed to the relevant game studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi) over an encrypted connection. Game providers receive only the minimum data needed to deliver the game and record the outcome. They are contractually prohibited from using your data for any other purpose.
• Identity Verification Partners: KYC documents may be processed by third-party identity verification services operating under confidentiality agreements. These services verify document authenticity and check submitted details against fraud databases.
• Analytics Providers: Aggregated, anonymised technical and usage data may be shared with analytics partners to help us understand platform performance. No personally identifiable information is included in these data sets.
• Legal & Regulatory Authorities: heybali will disclose personal data to law enforcement, financial intelligence units, or other competent governmental bodies when required to do so by law or court order, or when disclosure is necessary to protect the rights, property, or safety of heybali, its players, or the general public.

All third parties with whom heybali shares personal data are required to maintain appropriate technical and organisational security measures and to process your data only for the purposes specified in their agreements with heybali.

heybali uses cookies and similar tracking technologies (including local storage tokens and session identifiers) to operate the platform, personalise your experience, and analyse how the site is used. A cookie is a small text file placed on your device when you visit a website; it allows the site to recognise your browser on subsequent visits.

We use the following categories of cookies:

• Strictly Necessary Cookies: These are essential for the platform to function. They maintain your login session, remember your language and currency preferences, and enable core security features such as CSRF protection. These cookies cannot be disabled without impairing platform functionality.
• Functional Cookies: These remember choices you make — such as your preferred game lobby view, last-visited game, or notification preferences — to provide a more personalised experience. They persist across sessions but do not track activity outside heybali.
• Analytics Cookies: These collect anonymised data about how visitors navigate the platform — which pages are visited most often, how long sessions last, and where users exit the funnel. This data is used exclusively to improve the platform. No personally identifiable information is included in analytics data sets.
• Security Cookies: These support our fraud detection systems by recording signals such as login frequency, device fingerprint consistency, and geographic access patterns. They help us identify account takeover attempts and unusual activity.

You can configure your browser to refuse cookies or to alert you when cookies are being set. Note that disabling strictly necessary cookies will prevent you from logging into your heybali account. Disabling functional or analytics cookies will not prevent you from using the platform but may reduce the quality of your experience.

heybali implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. The following technical and organisational measures are in place:

• Encryption in Transit: All data exchanged between your browser or app and heybali's servers is encrypted using TLS 1.3. Connections using older, insecure protocol versions are rejected.
• Encryption at Rest: Personal data stored in our databases is encrypted using AES-256. Encryption keys are managed separately from the encrypted data using hardware security modules.
• Access Controls: Access to personal data is restricted to heybali personnel who require it to perform their job responsibilities. All internal access is role-based, logged, and subject to periodic review.
• Intrusion Detection: Our infrastructure is monitored continuously for anomalous access patterns. Automated alerts are triggered by unusual data access volumes or access attempts from unrecognised sources.
• Penetration Testing: heybali engages independent security firms to conduct penetration tests on our platform infrastructure. Identified vulnerabilities are remediated according to a risk-based priority schedule.
• Data Breach Response: In the event of a confirmed personal data breach that poses a risk to your rights and freedoms, heybali will notify affected players by email within 72 hours of becoming aware of the breach, describing the nature of the incident and the steps taken in response.

While heybali applies industry-standard security practices, no system connected to the internet can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying heybali promptly at [email protected] if you suspect that your account has been compromised.

As a registered player on heybali, you hold the following rights with respect to your personal data. To exercise any of these rights, submit a written request to [email protected] from the email address associated with your heybali account. We will respond within 30 days of receiving a valid request.

• Right of Access: You may request a copy of all personal data that heybali holds about you, together with information about how it is processed and the legal basis for each processing activity.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update basic profile information directly from within your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. Note that certain data must be retained for specified periods to comply with legal obligations — in such cases, erasure will apply to all data not subject to a legal retention requirement.
• Right to Restriction: You may request that heybali restrict processing of your personal data while a rectification or objection request is under review, or where you contest the accuracy of the data we hold.
• Right to Data Portability: You may request that heybali provide your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) so that it can be transferred to another service provider.
• Right to Object to Marketing: You have the unconditional right to object to heybali processing your personal data for direct marketing purposes. On receipt of such an objection, we will cease all marketing communications to you immediately.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications or the processing of special category data), you may withdraw that consent at any time without affecting the lawfulness of processing conducted before the withdrawal.

heybali retains personal data only for as long as it is necessary to fulfil the purposes described in this Privacy Policy, or to satisfy applicable legal, regulatory, accounting, and reporting requirements. The following standard retention periods apply:

Once a retention period expires, personal data is either securely deleted using cryptographic erasure or anonymised so that it can no longer be linked to any individual. Anonymised data may be retained indefinitely for aggregate statistical analysis.

Where you have requested self-exclusion for responsible gaming purposes, heybali retains sufficient data after account closure to enforce the exclusion period and prevent re-registration. This retention is in your interest and is treated as a legal obligation for the duration of the self-exclusion term.

heybali reviews this Privacy Policy periodically and updates it whenever our data practices change, new features are introduced that affect personal data processing, or applicable law requires a revision. The effective date at the top of this page always reflects when the current version came into force.

When we make material changes — meaning changes that substantially affect how we collect, use, or share your personal data, or that reduce your rights — we will notify you by email to the address registered on your heybali account at least 14 days before the change takes effect. For minor or administrative changes, such as corrections of typographical errors or clarifications that do not alter the substance of our practices, we may update the page without advance notification.

Your continued use of the heybali platform after a revised Privacy Policy comes into effect constitutes your acknowledgement of the revised terms. If you do not agree with any revision, you should discontinue using the platform and request account closure before the revision takes effect.