hagy Privacy Policy

1.1 hagy ("hagy", "we", "us", "our") operates the online gaming and sports betting platform accessible at hagy.io. In the course of providing our Services to players across Bangladesh — including in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar — hagy necessarily collects and processes certain personal data about its users.

1.2 This Privacy Policy sets out hagy's practices with respect to the collection, use, storage, disclosure, and protection of personal data. It has been prepared to ensure that hagy's users are fully informed about how their information is handled and to describe the rights that users hold in relation to their personal data.

1.3 This Privacy Policy should be read in conjunction with hagy's Terms and Conditions, available at hagy.io/terms-conditions, and hagy's Responsible Gaming Policy, available at hagy.io/responsible-gaming. Where any conflict arises between this Privacy Policy and hagy's Terms and Conditions, the Terms and Conditions shall prevail in respect of any matter not exclusively related to data protection.

1.4 The authoritative language of this Privacy Policy is English. Any translation provided for user convenience is for informational purposes only and does not modify, supersede, or supplement the English text in any respect.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, contact details, financial identifiers, and technical identifiers such as IP address.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, retrieval, use, disclosure, and deletion.
• "Data Controller" means hagy in its capacity as the entity that determines the purposes and means by which Personal Data is processed.
• "Data Processor" means a third party that processes Personal Data on hagy's behalf and under hagy's documented instructions.
• "Platform" means the hagy website at hagy.io, including all pages, games, betting markets, account management systems, and payment interfaces accessible thereunder.
• "Player" / "User" means any natural person who accesses or uses the Platform in any capacity.
• "Cookies" means small text files placed on a user's device by a web server to store information about that user's session or preferences.
• "Bangladesh Standard Time" ("BST") means UTC+6, the standard time zone applicable to all time-referenced operations on the hagy Platform.

3.1 hagy collects the following categories of Personal Data in connection with the operation of the Platform:

Identity Data: Full legal name, date of birth, gender, and identity document details (such as national ID card number, passport number, or driving licence number) provided during registration or identity verification.

Contact Data: Mobile phone number, email address, and general location information such as city and division within Bangladesh (e.g., Dhaka, Chittagong, Sylhet). hagy does not collect precise GPS or real-time location data.

Financial Data: Mobile wallet identifiers associated with bKash, Nagad, Rocket, Upay, or SureCash transactions; bank account reference numbers for bank transfer channels including Dutch-Bangla Bank, BRAC Bank, Islami Bank, Sonali Bank, and City Bank; and a complete record of all deposits, withdrawals, wagers, and bonus transactions conducted through your hagy account. hagy does not store mobile wallet PINs or full bank account numbers on its servers.

Account Activity Data: Login history, bet placement records, game session data, VIP tier progression, bonus claims and usage, responsible gaming tool configurations, and any communication sent to or received from hagy support.

Technical Data: IP address, device identifier, browser type and version, operating system, referring URL, pages visited within hagy.io, time spent on pages, and session token data generated upon login.

Preferences Data: Notification and communication preferences, language settings, and self-imposed responsible gaming limits such as deposit caps and session time restrictions.

3.2 hagy does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health information beyond what is relevant to responsible gaming assessments, or sexual orientation.

4.1 hagy collects Personal Data through the following channels:

• Direct submission: Information you provide when completing the hagy registration form, submitting identity verification documents, making deposits or withdrawals, contacting hagy support, or responding to surveys and promotional campaigns;
• Automated collection: Technical and behavioural data collected automatically when you access hagy.io, including via cookies, web beacons, session recording tools, and server log files (see Section 8 for full details on cookies);
• Payment providers: Transaction confirmation data returned by bKash, Nagad, Rocket, Upay, SureCash, and supported banking partners following a payment instruction initiated by you;
• Identity verification partners: Verification outcomes and document authenticity assessments returned by hagy's third-party KYC (Know Your Customer) service providers;
• Fraud prevention services: Risk scores and device fingerprint data provided by fraud detection platforms integrated into the hagy account opening and login workflows.

4.2 hagy does not purchase Personal Data from data brokers or acquire personal data lists from third parties for marketing outreach purposes.

5.1 Contractual necessity: Processing your Identity Data, Contact Data, and Financial Data is necessary to create and manage your hagy account, process your deposits and withdrawals, deliver gaming and betting services, and communicate with you regarding your account. Without this processing, hagy cannot perform its obligations to you as a Platform user.

5.2 Legal obligation: hagy is required by applicable anti-money laundering regulations, counter-terrorism financing rules, and record-keeping requirements to collect identity documentation, retain transaction records for a minimum of seven years, and in certain circumstances report activity to relevant financial authorities. Processing for these purposes is mandatory and cannot be refused by a Player.

5.3 Legitimate interests: hagy processes Technical Data and Account Activity Data on the basis of its legitimate interests in operating a secure, fair, and commercially viable platform. This includes fraud detection, abuse prevention, platform performance monitoring, and internal analytics. hagy has assessed that these interests are not overridden by the interests or fundamental rights of Players.

5.4 Consent: Where hagy sends you optional marketing communications — such as promotional emails, SMS notifications about BPL betting markets, or seasonal offers tied to Eid, Victory Day, or Pohela Boishakh — processing is based on your prior consent. You may withdraw this consent at any time (see Section 13).

6.1 hagy uses your Personal Data for the following purposes:

• To create, maintain, verify, and secure your hagy account;
• To process deposits via bKash, Nagad, Rocket, Upay, SureCash, and supported bank channels, and to process withdrawal requests to your registered payment accounts;
• To verify your identity and age (21+) in compliance with hagy's Terms and Conditions and applicable legal requirements;
• To deliver sports betting markets, casino games (including live dealer tables from Evolution Gaming and Ezugi, and slots from Pragmatic Play, NetEnt, and Microgaming), Super Keno, All-Star Fishing, and all other Platform Services;
• To calculate and credit bonus entitlements, VIP points, and promotional rewards in accordance with hagy's current offer terms;
• To monitor account activity for signs of problem gambling and to apply responsible gaming tools as requested by you or identified as necessary by hagy's responsible gaming programme;
• To detect, investigate, and prevent fraud, collusion, multi-accounting, bonus abuse, and any other prohibited conduct under hagy's Terms and Conditions;
• To respond to your support enquiries, complaints, and dispute submissions;
• To comply with applicable anti-money laundering, counter-terrorism financing, and tax reporting obligations;
• To send you service communications — including security alerts, account status updates, and policy change notifications — that are necessary irrespective of your marketing preferences;
• To send you optional promotional communications about hagy offers, new games, and betting markets, where you have provided consent to receive them (see Section 13);
• To conduct internal analytics to understand Platform usage patterns and improve hagy's product and service offerings.

6.2 hagy does not use automated decision-making that produces legal or similarly significant effects for individual Players, except in the context of fraud prevention systems where automated risk scoring may result in a temporary account hold pending manual review. In such cases, Players may request human review of the automated decision by contacting [email protected].

7.1 hagy may share your Personal Data with the following categories of third parties:

• Payment processors: bKash, Nagad, Rocket, Upay, SureCash, and supported banking institutions receive only the transaction data necessary to execute your requested payment. These entities operate under their own privacy policies and regulatory frameworks applicable to mobile financial services in Bangladesh;
• Identity verification providers: Third-party KYC service providers receive identity document images and personal details solely to perform age and identity verification checks. These providers are bound by strict data protection agreements with hagy;
• Fraud detection and security services: Technical data including IP addresses, device identifiers, and session data may be shared with fraud prevention platforms to assess account risk and detect prohibited conduct;
• Game technology providers: Game studios and live dealer platform operators (including Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe) may receive limited technical and account reference data necessary to authenticate your game session and record game outcomes;
• Customer support platforms: Support ticket systems used by hagy's support team may process your Contact Data and Communications Data to manage enquiry workflows;
• Legal and regulatory authorities: hagy may disclose Personal Data to government authorities, financial intelligence units, law enforcement agencies, or courts where required to do so by applicable law, regulation, or lawful order. hagy will notify affected Players of such disclosures where legally permitted to do so.

7.2 All third-party Data Processors engaged by hagy are required to process Personal Data only on hagy's documented instructions, to maintain appropriate security standards, and to delete or return data upon termination of their engagement with hagy.

8.1 hagy.io uses cookies and similar tracking technologies to operate the Platform, remember your session, maintain your login state, detect fraud, and analyse how users navigate the site. The categories of cookies used by hagy are as follows:

• Essential cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load balancing cookies. These cookies cannot be disabled without impairing Platform functionality;
• Functional cookies: Used to remember your preferences such as language settings, responsible gaming configurations, and notification choices across sessions;
• Analytics cookies: Used to collect aggregated and anonymised data about how players navigate hagy.io, which pages receive the most traffic, and where users encounter friction in the account journey. This data helps hagy improve the Platform experience;
• Security cookies: Used by hagy's fraud detection systems to identify unusual access patterns, detect bot activity, and flag potential account takeover attempts.

8.2 hagy does not use third-party advertising or retargeting cookies that track your activity across websites other than hagy.io.

8.3 You may manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging into your hagy account. Disabling functional cookies will mean that your preferences are not retained between sessions.

8.4 hagy does not use cross-site tracking technologies, fingerprinting for persistent identification beyond session management, or any tracking technology that circumvents standard browser privacy controls.

9.1 hagy implements a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. Security measures in place include:

• TLS 1.2 and above encryption for all data transmitted between your device and hagy.io;
• AES-256 encryption for Personal Data and Financial Data stored on hagy servers;
• Access controls that limit employee access to Personal Data on a strict need-to-know basis, with all access logged and periodically audited;
• Multi-factor authentication requirements for all internal hagy staff accounts with access to Player data systems;
• Regular vulnerability assessments and penetration testing conducted by qualified security professionals;
• Automated intrusion detection and anomaly monitoring across hagy's server infrastructure.

9.2 In the event of a data security incident that materially affects your Personal Data, hagy will notify affected Players via the contact details on file as soon as reasonably practicable, and in any case within 72 hours of becoming aware of the incident where notification is required.

9.3 hagy strongly recommends that Players take their own security precautions, including using a strong, unique password for their hagy account, never sharing account credentials with third parties, and ensuring their mobile device is protected by a PIN or biometric lock given the use of mobile payment methods including bKash and Nagad.

10.1 hagy retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve any outstanding disputes. The standard retention periods applicable to each data category are:

• Identity Data and Contact Data: Retained for a minimum of 5 years following account closure, in compliance with anti-money laundering record-keeping requirements;
• Financial Data (transaction records): Retained for a minimum of 7 years from the date of each transaction, in compliance with applicable financial record-keeping obligations;
• Account Activity Data: Retained for 5 years following account closure for dispute resolution, responsible gaming review, and regulatory audit purposes;
• Technical Data: Retained for 12 months from collection, after which it is anonymised or deleted;
• Communications Data (support records): Retained for 5 years from the date of the last communication in each support interaction;
• Consent records (marketing): Retained for 5 years from the date of consent or withdrawal of consent, as evidence of compliance with applicable marketing communication rules.

10.2 Where hagy is required by a court order, regulatory direction, or ongoing investigation to retain data beyond the standard periods, hagy will do so and will inform the relevant Player of the extended retention obligation where legally permitted.

10.3 Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with hagy's data deletion procedures.

11.1 As a hagy Platform user, you hold the following rights with respect to your Personal Data:

• Right of access: You may request a copy of all Personal Data that hagy holds about you, along with information about how it is processed and with whom it is shared;
• Right of rectification: You may request that hagy correct any inaccurate or incomplete Personal Data held in your account. Minor corrections (such as updating your contact number) may be made directly in your account dashboard;
• Right of erasure: You may request that hagy delete your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent on which processing is based, or where you object to processing and hagy has no overriding legitimate grounds to continue. Note that hagy may be legally required to retain certain data categories despite an erasure request (see Section 10);
• Right to restrict processing: You may request that hagy limit the processing of your Personal Data — for example, while hagy investigates the accuracy of data you have disputed, or pending the outcome of an objection to processing;
• Right to data portability: You may request that hagy provide your Personal Data in a structured, commonly used, machine-readable format, or transfer it directly to another controller where technically feasible, in respect of data processed on the basis of consent or contractual necessity;
• Right to object: You may object to hagy's processing of your Personal Data where that processing is based on hagy's legitimate interests. hagy will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defence of legal claims;
• Right to withdraw consent: Where hagy processes your data on the basis of your consent (primarily for optional marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

11.2 hagy will not charge a fee for processing legitimate data rights requests unless a request is manifestly unfounded or excessive, in which case hagy may charge a reasonable administrative fee or decline to process the request, providing written reasons for doing so.