hzay Privacy Policy

hzay operates hzay.ws, an online casino and sports betting platform serving adult players in Bangladesh. For the purposes of this Policy, hzay is the data controller — meaning hzay determines the purposes for which and the manner in which personal data about you is processed.

If you have any questions, concerns, or requests relating to this Privacy Policy or to your personal data held by hzay, please contact the hzay support team via the live chat or support email address published on hzay.ws. hzay aims to respond to all privacy-related enquiries within 5 business days.

When you register an account, use hzay's services, or interact with the platform, hzay collects the following categories of personal data:

• Identity data — full name, date of birth, and a copy of government-issued identity documentation (national ID card, passport, or driving licence) collected as part of mandatory Know Your Customer (KYC) verification.
• Contact data — mobile phone number and email address used during registration and for ongoing account communications including transaction confirmations, security alerts, and promotional offers (where opted in).
• Financial data — payment method identifiers (bKash or Nagad account numbers, Rocket wallet references, or partial card numbers for Visa and Mastercard transactions), deposit and withdrawal amounts, and transaction timestamps. hzay does not store full card numbers or card authentication values on its servers.
• Technical data — IP address, device type and operating system, browser type and version, mobile network operator, session duration, and page interaction data collected automatically when you access hzay.ws.
• Behavioural data — betting history, game play records, bonus participation history, and responsible gaming tool usage. This data is used to detect unusual patterns, manage responsible gaming obligations, and where applicable provide personalised offers.

hzay uses your personal data only for legitimate purposes directly related to the services we provide. The primary purposes for which your data is processed are:

• Account administration — creating and managing your hzay account, verifying your identity in accordance with KYC requirements, processing deposits and withdrawals, and communicating account-related information to you.
• Service delivery — operating the betting, casino, and fish game functions of the platform; settling bets; crediting winnings; and applying bonuses or promotional credits as applicable.
• Fraud prevention and security — detecting and investigating suspicious activity, preventing money laundering, and ensuring that the platform is not used in breach of hzay's Terms and Conditions or applicable law.
• Responsible gaming — monitoring betting patterns to identify players who may be exhibiting signs of problem gambling, and contacting affected players to offer responsible gaming tools in accordance with hzay's responsible gaming policy.

hzay does not sell, rent, or trade your personal data to any third party. hzay may share your data in the following limited circumstances only:

• Payment processors — hzay shares the minimum necessary financial data with bKash, Nagad, Rocket, and card payment networks (Visa, Mastercard) solely to process deposits and withdrawals on your behalf. These processors are bound by their own privacy frameworks and applicable financial regulation.
• Technology and game providers — hzay uses licensed game platforms from providers such as Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Ezugi. These providers may receive session and gameplay data in order to deliver their games. They do not receive your identity or financial data beyond what is technically necessary for game operation.
• Legal and regulatory authorities — hzay may be required to disclose personal data to government bodies, law enforcement agencies, or financial intelligence units in Bangladesh or other jurisdictions where hzay operates, in response to a valid legal order, warrant, or regulatory obligation.

In all cases where hzay shares data with third parties, hzay takes reasonable steps to ensure those parties handle your data responsibly and in a manner consistent with this Policy. hzay does not authorise any third party to use your personal data for their own independent marketing purposes.

hzay uses cookies and similar tracking technologies on hzay.ws to ensure the platform functions correctly, to remember your session preferences, and to collect anonymised analytics data that helps hzay improve the user experience. The types of cookies used by hzay include: (a) Strictly necessary cookies — essential for core platform functions such as maintaining your login session and processing bets. These cannot be disabled without impairing platform functionality. (b) Analytics cookies — used to collect aggregated, anonymised data about how players navigate hzay.ws, which games are most frequently played, and where technical issues occur. hzay uses this data internally only. (c) Preference cookies — used to remember optional settings you have applied within your hzay account, such as language or display preferences.

You may control non-essential cookies through your browser's cookie settings. Please be aware that disabling certain cookies may affect how some features of hzay.ws work. hzay does not use third-party advertising cookies or behavioural targeting technologies that track your activity across other websites.

hzay implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• SSL (Secure Sockets Layer) encryption for all data transmitted between your device and hzay's servers, ensuring that your login credentials, payment information, and personal details cannot be intercepted in transit.
• Access controls — only authorised hzay personnel with a legitimate operational need may access your personal data. All staff who handle personal data are trained in data protection and are bound by confidentiality obligations.
• Regular security reviews — hzay conducts periodic reviews of its data security practices and infrastructure to identify and address potential vulnerabilities before they can be exploited.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data breach that is likely to affect your rights and freedoms, hzay will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

As a user of hzay, you have the following rights in relation to your personal data. To exercise any of these rights, contact hzay's support team. hzay will respond within 5 business days and will aim to fulfil all valid requests within 30 days:

• Right of access — you may request a copy of the personal data hzay holds about you, along with information about how that data is being used.
• Right to rectification — if any personal data held by hzay about you is inaccurate or incomplete, you may request that it be corrected or completed without undue delay.
• Right to erasure — you may request that hzay delete your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent. Note that hzay may be required to retain certain data for legal, regulatory, or fraud-prevention purposes even after account closure.
• Right to restriction — you may request that hzay restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or where you have objected to processing pending verification of hzay's legitimate grounds.
• Right to object — where hzay processes your data on the basis of legitimate interests, you have the right to object to that processing. hzay will stop processing the data unless hzay can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims.

hzay retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting obligations. As a general guide: account data and identity verification documents are retained for a minimum of 5 years from the date of account closure; transaction and financial records are retained for a minimum of 5 years from the date of each transaction; and responsible gaming records are retained for a minimum of 3 years from the date on which the relevant tool was applied.

When personal data is no longer required, hzay will sec urely delete or anonymise it in accordance with hzay's internal data destruction procedures. Where anonymisation is used, the resulting data no longer identifies you and may be retained indefinitely for aggregated statistical analysis.

hzay's services are strictly for adults aged 21 and above. hzay does not knowingly collect personal data from individuals under the age of 21. If hzay becomes aware that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account will be closed without notice. If you are a parent or guardian and believe that a minor has registered an account with hzay, please contact hzay's support team immediately so that the matter can be investigated and the account closed.

hzay employs age verification procedures as part of its KYC process and takes the protection of minors seriously. Any player found to have misrepresented their age during registration will have their account permanently closed and any winnings or balances will be forfeited in full. hzay encourages parents and guardians to use parental control tools available through mobile network operators and internet service providers to prevent underage access to online gambling platforms.

hzay may send you promotional communications about bonuses, new games, seasonal offers, and platform updates. hzay will only send marketing communications to you by the following channels, and only if you have opted in during registration or subsequently via your account settings:

• SMS to your registered mobile number
• Email to your registered email address
• In-platform notifications displayed within your hzay account when you are logged in
• Push notifications via the hzay mobile web app, if you have enabled push notifications in your browser
• WhatsApp or Telegram, only if you have explicitly provided consent to be contacted via those channels

You may withdraw your consent to receive marketing communications at any time by updating your preferences in your account settings or by contacting hzay's support team. Opting out of marketing communications will not affect the delivery of essential transactional communications such as deposit confirmations, withdrawal notifications, or security alerts.

hzay may update this Privacy Policy from time to time to reflect changes in how we collect or use personal data, changes in applicable law, or improvements to our security practices. The date of the most recent revision is displayed at the top of this page. Where changes are material — for example, where hzay begins processing a new category of personal data, or shares data with a new category of third party — hzay will notify registered players via their registered contact details at least 7 days before the change takes effect.

Your continued use of hzay after this Privacy Policy is updated constitutes your acceptance of the revised Policy. If you do not agree to the updated Policy, you should stop using hzay and contact support to close your account. hzay will not be liable for any loss arising from your continued use of the platform following a Policy update you did not read.

This Privacy Policy is governed by and interpreted in accordance with applicable law. Any dispute arising from this Policy that cannot be resolved through hzay's internal support process may be referred to independent legal counsel. hzay does not submit to the jurisdiction of any specific court by virtue of this Policy alone.

This Policy constitutes the complete statement of hzay's privacy practices with respect to the information collected via hzay.ws. It supersedes any prior privacy notices, statements, or representations made by hzay in any other format or channel. If any provision of this Policy is found to be unenforceable, the remaining provisions will continue in full force and effect.