Privacy Policy

1. Information We Collect

heyjita collects personal data through several channels: information you provide directly during the registration and verification process, data generated automatically through your use of the platform, and — in limited circumstances — information obtained from third-party service providers acting on our behalf. Below is a detailed breakdown of each category.

1.1 Information You Provide Directly

Data Category	Specific Examples	When Collected
Identity Data	Full legal name, date of birth, NID / passport number, photograph	Registration & KYC verification
Contact Data	Mobile number, email address, residential address (division, district, city)	Registration
Financial Data	bKash / Nagad / Rocket account number, bank name, account holder name	First deposit & withdrawal requests
Account Credentials	Username, hashed password, security questions	Registration
Communications	Live chat transcripts, support emails, feedback submissions	Ongoing platform use

1.2 Data Collected Automatically

When you access heyjita, our systems automatically record certain technical and behavioural data. This includes your IP address, device type and operating system, browser type and version, referring URL, pages visited within heyjita, session duration, click-path data, and game activity records (bets placed, games played, outcomes). This data is collected through server logs, cookies, and similar tracking technologies described in Section 4 of this Policy.

Geolocation data at a city or regional level (for example, Dhaka, Chittagong, or Sylhet) may be inferred from your IP address for fraud prevention and regulatory compliance purposes. heyjita does not collect precise GPS coordinates from your device.

1.3 Data from Third-Party Service Providers

In certain circumstances, heyjita may receive personal data about you from third parties engaged to deliver specific services. These include identity verification providers who confirm the authenticity of documents submitted during KYC checks, payment processors who confirm transaction status, and fraud detection partners who provide risk signals based on device fingerprinting and behavioural analytics. Data received from these providers is processed strictly in accordance with this Privacy Policy.

2. How We Use Your Data

heyjita processes personal data on the basis of several legal grounds: contractual necessity (to deliver the services you have signed up for), compliance with legal obligations (such as anti-money laundering and age verification requirements), and legitimate interests (such as fraud prevention and service improvement). Where we rely on your consent — for example, for marketing communications — you may withdraw that consent at any time.

The specific purposes for which we use your personal data are as follows:

• Account creation and management: To register your account, verify your identity, process your deposits and withdrawals, and maintain your account history on heyjita;
• Service delivery: To provide access to our full range of gaming products including sports betting, live casino, slots, and crash games in a personalised and seamless manner;
• Payment processing: To initiate, verify, and record all financial transactions conducted through bKash, Nagad, Rocket, Upay, and card payment networks;
• Regulatory compliance: To meet our obligations under applicable anti-money laundering (AML) and Know Your Customer (KYC) requirements, including the verification and ongoing monitoring of player accounts;
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, multiple-account abuse, bonus exploitation, and unauthorised access to player accounts;
• Responsible gaming: To monitor playing patterns and identify indicators of problem gambling behaviour, enabling us to apply self-exclusion measures, deposit limits, or account restrictions where appropriate;
• Customer support: To respond to your enquiries, complaints, and support requests promptly and accurately;
• Marketing and promotions: Subject to your consent, to send you information about heyjita promotions, bonuses, seasonal offers tied to events such as BPL season or Eid, and platform updates via email or SMS. You may opt out of marketing communications at any time;
• Platform improvement: To analyse aggregated usage patterns, optimise the user interface, and develop new features that better serve our Bangladesh player base.

heyjita will not use your personal data for any purpose that is incompatible with the purposes listed above without first providing you with notice and, where required, obtaining your consent.

3. Data Sharing & Third Parties

heyjita does not sell personal data to unrelated third parties. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and partner banks (including BRAC Bank, City Bank, Dutch-Bangla Bank) receive transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy frameworks and security standards.
• Identity verification providers: Third-party KYC partners may receive copies of your identity documents and personal details for the purpose of verifying your age and identity in accordance with our compliance obligations.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, Spribe, Microgaming, NetEnt, and Ezugi may receive your player ID and session data in order to deliver their game software. These providers do not receive your full identity or financial data.
• Fraud and security vendors: Specialist third-party partners may process your device fingerprint, IP address, and behavioural data to generate risk scores that support our fraud detection systems.
• Legal and regulatory authorities: heyjita may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law or a valid legal order. We will notify you of such disclosures where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of heyjita's assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third-party service providers engaged by heyjita are subject to contractual data processing obligations that require them to handle your personal data securely, use it only for the purposes specified, and not disclose it to further parties without authorisation.

4. Cookies & Tracking Technologies

heyjita uses cookies and similar technologies (including local storage objects and pixel tags) to operate the platform, personalise your experience, and support our analytics and security functions. Cookies are small text files placed on your device when you visit our site. They allow heyjita to recognise your browser, remember your preferences, and maintain your login session.

We use the following categories of cookies:

• Strictly necessary cookies: Essential to the operation of heyjita. These enable core functions such as user authentication, session management, and fraud prevention. They cannot be disabled without impairing platform functionality.
• Performance and analytics cookies: These collect aggregated, anonymised data about how players interact with heyjita — which pages are visited most frequently, how long sessions last, and where users encounter errors. This data is used solely to improve platform performance.
• Functionality cookies: These remember your preferences such as language settings, preferred payment method, and display configurations to provide a more personalised experience on subsequent visits.
• Targeting and marketing cookies: Subject to your consent, these cookies track your browsing activity to enable more relevant promotional messaging. You may withdraw consent for this category of cookies at any time via your account settings.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect the functionality of heyjita and may prevent you from accessing certain features, including your account and the gaming lobby.

5. Data Retention

heyjita retains personal data for as long as is necessary to fulfil the purposes for which it was collected, as described in this Policy, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: Retained for the duration of your account's active status on heyjita, plus a minimum period of five years following account closure to meet our AML and KYC record-keeping obligations.
• Transaction records: Financial transaction history is retained for a minimum of seven years in line with standard financial record-keeping requirements.
• KYC documents: Identity verification documents are retained for five years from the date of account closure or the date of the most recent verification check, whichever is later.
• Support communications: Live chat transcripts and support email records are retained for three years from the date of the relevant interaction.
• Marketing consent records: Records of your consent (or withdrawal of consent) for marketing communications are retained for the duration of your account plus three years.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Where deletion is not immediately practicable due to technical constraints, the data will be isolated and protected from further processing until deletion is possible.

6. Your Privacy Rights

heyjita respects your rights with respect to your personal data. The following rights are available to you as a heyjita player:

• Right of access: You have the right to request a copy of all personal data that heyjita holds about you. Requests will be fulfilled within 30 days of receipt.
• Right to rectification: If any personal data we hold is inaccurate or incomplete, you have the right to request that it be corrected. Minor account details such as contact information can be updated directly in your account settings.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Note that AML and KYC records cannot be deleted before the mandatory retention period has elapsed.
• Right to restriction of processing: You may request that heyjita restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to data portability: You may request that heyjita provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to withdraw consent: Where heyjita processes your data on the basis of consent (such as for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to object: You have the right to object to processing of your personal data based on heyjita's legitimate interests, where you believe your individual rights and freedoms outweigh those interests.

To exercise any of the above rights, please contact our Data Protection team at support@heyjita with the subject line "Privacy Rights Request". We will acknowledge your request within five business days and fulfil it within 30 days, unless an extension is required due to the complexity or volume of requests, in which case we will notify you accordingly.

7. Data Security Measures

heyjita implements a multi-layered security framework to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Our technical and organisational security measures include the following:

• Transport Layer Security (TLS): All data exchanged between your browser or app and heyjita's servers is encrypted in transit using TLS 1.2 or higher.
• Data encryption at rest: Sensitive data fields including passwords (stored as salted hashes), identity document images, and financial identifiers are encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within heyjita is restricted on a strict need-to-know basis. Staff members are granted the minimum level of access necessary to perform their role, and all access is logged and audited.
• Two-factor authentication (2FA): Players are strongly encouraged to enable 2FA on their heyjita accounts. 2FA is mandatory for all internal staff accounts with access to production systems.
• Penetration testing and vulnerability management: heyjita conducts regular security assessments of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data security incident that poses a risk to your rights and freedoms, heyjita will notify affected players without undue delay and take immediate steps to contain and remediate the breach.

While heyjita takes all reasonable measures to protect your data, no platform can guarantee absolute security against all possible threats. Players are reminded to protect their own account credentials, use strong unique passwords, enable 2FA, and report any suspected unauthorised account activity to support@heyjita immediately.

8. Changes to This Policy

heyjita may update this Privacy Policy from time to time to reflect changes in our data practices, the services we offer, or applicable legal requirements. When we make material changes to this Policy, we will notify registered players by email to the address associated with their heyjita account and will update the "Last Updated" date displayed at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how heyjita protects your personal data. Your continued use of the platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms, to the extent permitted by applicable law.

If you have any questions, concerns, or complaints regarding this Privacy Policy or heyjita's data practices, please contact us at support@heyjita. We take all privacy enquiries seriously and will respond within five business days.