hybaji Privacy Policy

hybaji ("we", "us", "our") is committed to protecting and respecting the privacy of every individual who visits, registers on, or interacts with the hybaji platform at hybaji.club. This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by hybaji.

This Policy applies to all users of the hybaji website, mobile application, customer support channels, and any other digital touchpoint operated by hybaji. It covers the collection, use, storage, transfer, and deletion of personal data in connection with your use of the hybaji platform.

hybaji serves players based in Bangladesh, including users located in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. This Policy is written in English and governs all data processing activities related to our Bangladesh-market operations.

hybaji collects personal data in several ways: directly from you when you register or interact with the platform, automatically through technical systems as you use the site, and in limited circumstances from trusted third-party sources for identity verification purposes. The categories of personal data we collect include the following:

Identity & Contact Data:

• Full legal name, date of birth, and gender as provided during account registration.
• Residential address, including city, district, and postcode within Bangladesh.
• Email address and mobile phone number used for account communications and OTP verification.
• National Identity Card number, passport number, or driving licence number collected during KYC (Know Your Customer) verification.

Financial Data:

• bKash, Nagad, Rocket, or Upay mobile financial service account numbers linked to your hybaji account for deposits and withdrawals.
• Bank account details (account number, bank name such as Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, or Sonali Bank) where bank transfer is used.
• Visa or Mastercard details where card payments are processed (card number, expiry date, and billing name — CVV is never stored).
• Transaction history, deposit amounts, withdrawal requests, and account balance records.

Technical & Usage Data:

• IP address, browser type and version, operating system, device type, and screen resolution.
• Login timestamps, session duration, pages visited, games played, bets placed, and in-platform navigation patterns.
• Cookies and similar tracking technologies as described in Section 6 of this Policy.

Communications Data:

• Records of communications between you and the hybaji support team, including email correspondence, live chat transcripts, and support ticket content.
• Responses to surveys, feedback forms, or promotional communications you choose to participate in.

hybaji uses the personal data it collects for the following purposes. Each purpose is tied to a specific legal basis described in Section 4 of this Policy:

• Account Management: To create and maintain your hybaji player account, verify your identity, manage your credentials, and communicate important account-related notifications to you.
• Payment Processing: To process deposits made via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and card networks, and to execute withdrawal requests to your nominated payment method.
• KYC & Fraud Prevention: To verify your identity and age (18+ requirement), detect and prevent fraudulent activity, money laundering, and multi-account abuse, and to comply with anti-money laundering (AML) obligations.
• Platform Personalisation: To customise your gaming experience, recommend games aligned with your play history, and display promotions relevant to your account status (e.g., welcome bonus eligibility, BPL season offers, Eid promotions).
• Customer Support: To respond to your enquiries, resolve disputes, investigate complaints, and provide assistance in connection with your hybaji account.
• Responsible Gaming: To monitor gaming behaviour for indicators of problem gambling, enforce deposit limits and self-exclusion requests, and deliver session time reminders in Bangladesh Standard Time (BST, UTC+6).
• Legal Compliance: To fulfil our legal and regulatory obligations, respond to lawful requests from authorities, and maintain records as required by applicable law.
• Platform Improvement: To analyse usage patterns, diagnose technical issues, conduct internal research, and improve the performance, security, and features of the hybaji platform.
• Marketing Communications: To send you promotional emails or SMS messages about hybaji bonuses, new games, and seasonal offers — only where you have provided your consent or where permitted by applicable law. You may opt out at any time.

hybaji does not use automated decision-making or profiling that produces legal or similarly significant effects on individual players without human review. Any automated systems used for fraud detection or responsible gaming monitoring are subject to manual oversight by the hybaji compliance team.

hybaji processes your personal data only where a valid legal basis exists for doing so. The legal bases we rely on are as follows:

• Contractual Necessity: Processing is necessary to perform the contract between you and hybaji — specifically, to operate your account, process payments, and deliver gaming services you have requested.
• Legal Obligation: Processing is necessary to comply with legal obligations applicable to hybaji, including KYC/AML requirements, age verification, and responses to lawful regulatory requests.
• Legitimate Interests: hybaji processes certain data for its legitimate business interests, including fraud prevention, platform security, customer support quality improvement, and responsible gaming monitoring. We conduct a balancing test to ensure these interests do not override your fundamental privacy rights.
• Consent: For marketing communications and certain non-essential cookies, hybaji relies on your freely given, specific, and informed consent. You may withdraw consent at any time without detriment to your account standing.

hybaji does not sell, rent, or trade your personal data to third parties for commercial gain. We share your data only in the following limited circumstances, and only to the minimum extent necessary:

• Game Providers: Licensed game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive limited technical data (session tokens, game round identifiers) necessary to deliver their games to your device. These providers process data under their own privacy policies and contractual obligations to hybaji.
• Payment Processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and partner banks receive the financial data necessary to process your deposit or withdrawal transaction. These entities are subject to their own regulatory obligations regarding data security.
• Identity Verification Services: Where third-party KYC or age-verification services are used to validate identity documents, your submitted ID data is shared with those providers under strict data processing agreements and deleted from their systems upon verification completion.
• Legal & Regulatory Authorities: hybaji may disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies where required by applicable law, court order, or legitimate legal process. hybaji will notify you of such disclosure where legally permitted to do so.
• Service Providers: hybaji engages third-party service providers for technical infrastructure, cloud hosting, email delivery, customer support tools, and analytics. These providers act as data processors under written agreements that restrict their use of your data to the specific services they provide to hybaji.

All third parties to whom hybaji discloses personal data are required to maintain appropriate technical and organisational security measures and to process your data only for the purposes specified by hybaji.

hybaji uses cookies and similar tracking technologies to enhance platform functionality, maintain your login session, and analyse aggregate usage patterns. The categories of cookies used on the hybaji platform are as follows:

• Strictly Necessary Cookies: These cookies are essential for the hybaji platform to function. They maintain your login session, remember your language and currency preferences, and enable core security features such as CSRF protection. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: These cookies remember your in-platform preferences such as game display settings, preferred payment method, and notification preferences. Disabling functional cookies may reduce your personalised experience but will not prevent you from accessing the platform.
• Performance & Analytics Cookies: hybaji uses anonymised analytics data to understand how players navigate the platform, identify performance bottlenecks, and prioritise feature improvements. This data is processed in aggregate and is not linked to individual player identities.
• Marketing Cookies: With your consent, hybaji may use targeting cookies to deliver personalised promotional content within the hybaji platform. These cookies do not track your activity on external websites.

You may manage your cookie preferences through your browser settings at any time. Disabling all cookies may affect the functionality of the hybaji platform. For further information on the specific cookies in use and their retention durations, please contact [email protected].

hybaji retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal obligations. Our standard data retention periods are as follows:

• Active Account Data: Personal data associated with an active hybaji account is retained for the duration of the account relationship and for a period of five (5) years following account closure, to fulfil AML record-keeping obligations.
• Transaction Records: Financial transaction data, including deposit and withdrawal records, is retained for a minimum of seven (7) years to comply with financial record-keeping requirements.
• KYC Documents: Identity verification documents submitted for KYC purposes are retained for five (5) years from the date of submission or from the date of account closure, whichever is later.
• Support Communications: Records of customer support interactions are retained for three (3) years from the date of the interaction, to enable resolution of any related follow-up queries or disputes.
• Marketing Consent Records: Records of your marketing consent or opt-out are retained indefinitely as evidence of your preference history.
• Technical Logs: Server-side access logs and security audit logs are retained for a rolling period of twelve (12) months, after which they are securely deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Where data is anonymised rather than deleted, it may be retained indefinitely for statistical analysis.

hybaji implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security infrastructure includes the following controls:

• Transport Encryption: All data exchanged between your browser or mobile device and the hybaji platform is encrypted using 256-bit TLS (SSL) encryption. A valid SSL certificate is maintained at all times across the hybaji domain.
• Password Security: Player passwords are stored as salted cryptographic hashes using industry-standard algorithms. Plain-text passwords are never stored or transmitted.
• Access Controls: Access to player personal data within hybaji's internal systems is restricted on a strict need-to-know basis. Staff access is governed by role-based permissions and is subject to audit logging.
• OTP Verification: Sensitive account actions — including password changes, withdrawal requests above defined thresholds, and device additions — require one-time password (OTP) verification via your registered mobile number.
• Penetration Testing: hybaji conducts periodic security assessments of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a confirmed personal data breach that is likely to result in a risk to the rights and freedoms of affected players, hybaji will notify affected individuals within 72 hours of becoming aware of the breach, in accordance with applicable notification obligations.

As a hybaji player whose personal data is processed by us, you hold the following data subject rights. hybaji will respond to all verified rights requests within thirty (30) days of receipt:

hybaji may require you to verify your identity before processing any data subject rights request, to ensure that personal data is not disclosed to or acted upon at the direction of an unauthorised individual.

hybaji strictly enforces an 18+ age requirement across all services. The hybaji platform is not intended for, and does not knowingly collect personal data from, individuals under the age of 18. All registration flows include a mandatory age declaration and are subject to identity verification as part of the KYC process.

If hybaji becomes aware that personal data has been collected from a person under the age of 18, the associated account will be immediately suspended, all deposited funds will be returned to the originating payment method, and all personal data collected from that individual will be securely deleted within 30 days of discovery.

The hybaji platform may from time to time display informational references to third-party game providers, payment processors, or sporting event organisers (such as the BPL, IPL, ICC, or FIFA). These references do not constitute endorsement and do not create a data-sharing relationship unless explicitly described elsewhere in this Policy.

hybaji is not responsible for the privacy practices of third-party websites, applications, or platforms that operate outside the hybaji domain. If you navigate to any external service from a hybaji reference, we encourage you to review the privacy policy of that service directly. hybaji has no control over and accepts no responsibility for the data practices of third parties.

hybaji reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. When material changes are made to this Policy, hybaji will notify registered players by email to their registered address and will display a prominent update notice on the hybaji platform for a minimum of seven (7) days prior to the revised Policy taking effect.

The "Last Updated" date displayed in the header of this Policy reflects the date of the most recent revision. Minor amendments — such as typographical corrections or clarifications that do not change the substantive meaning of any provision — may be made without advance notice.

Your continued use of the hybaji platform after the effective date of any Policy update constitutes your acceptance of the revised Privacy Policy. If you do not agree with the updated Policy, you may close your account by contacting [email protected] before the updated Policy takes effect.

If you have any questions, concerns, or requests relating to this Privacy Policy or hybaji's handling of your personal data, please contact our dedicated privacy support team using the details below. All privacy-related enquiries are handled with strict confidentiality.

For formal data subject rights requests (access, correction, deletion, portability, objection, or restriction), please use the subject line formats listed in Section 9 of this Policy. hybaji will acknowledge receipt of your request within two (2) business days and will provide a substantive response within thirty (30) days.

All correspondence should be in English. hybaji's support team operates in Bangladesh Standard Time (BST, UTC+6) and is available around the clock for urgent account security matters.