hgxy Privacy Policy

Section 1

Data Controller

hgxy is the data controller responsible for the personal data collected and processed through the hgxy platform at hgxy.io. As data controller, hgxy determines the purposes and means of processing your personal data and is accountable for ensuring that such processing is carried out lawfully, fairly, and transparently.

All data-related enquiries, rights requests, and complaints should be addressed to our data team at [email protected] with the subject line "Privacy – [Your Request Type]". We commit to acknowledging all data enquiries within 5 business days and providing a substantive response within 30 calendar days.

Section 2

Data We Collect

hgxy collects personal data across several categories depending on how you interact with the platform. The main categories are as follows:

• Identity Data: Full legal name, date of birth, nationality, government-issued identification document details (National ID, passport, driving licence).
• Contact Data: Email address, mobile number, residential address, city, and postcode.
• Financial Data: Payment method details including bKash wallet number, Nagad wallet number, Rocket account, bank account details, and transaction history. Note: full payment card numbers are not stored by hgxy — card processing is handled by our PCI-DSS compliant payment partners.
• Technical Data: IP address, browser type and version, device type and identifiers, operating system, time zone setting, and access logs.
• Usage Data: Information about how you use the platform including game history, betting activity, session duration, pages visited, search queries within the platform, and responsible gaming tool usage.
• Communication Data: Records of support interactions, dispute submissions, emails, and live chat transcripts.
• Marketing and Preferences Data: Your opt-in or opt-out status for marketing communications, preferred communication channels, and promotional campaign interaction history.

Where you choose not to provide data that is required for a specific purpose (such as KYC identity data required for withdrawals), hgxy may be unable to provide the service or feature that depends on that data.

Section 3

How We Collect Data

hgxy collects personal data through the following means:

• Direct collection: Data you provide to us when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in promotions.
• Automated technical collection: Data collected automatically when you access the platform, including IP addresses, session identifiers, device fingerprinting, and cookie-based tracking. See Section 5 for full details on cookies.
• Third-party sources: Data received from identity verification agencies, payment processors, and fraud prevention services to supplement the information you provide directly and to verify its accuracy.
• Public sources: In limited circumstances, hgxy may verify information against publicly available records such as electoral registers or public court records as part of fraud and AML screening.

Section 4

How We Use Your Data

hgxy uses your personal data for the following purposes, each supported by a clear lawful basis:

• Account administration: Creating, maintaining, and securing your player account. Lawful basis: contractual necessity.
• Identity and age verification (KYC): Confirming that you meet the minimum age requirement of 21 and that your identity matches the payment methods registered on your account. Lawful basis: legal obligation; contractual necessity.
• Payment processing: Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, BRAC Bank, and other accepted methods. Lawful basis: contractual necessity.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, money laundering, and other prohibited conduct. Lawful basis: legitimate interest; legal obligation.
• Responsible gaming: Monitoring usage patterns to identify potential problem gambling behaviour and, where appropriate, initiating protective measures in line with our Responsible Gaming Policy. Lawful basis: legitimate interest; legal obligation.
• Customer support: Responding to queries, resolving disputes, and maintaining support records. Lawful basis: contractual necessity; legitimate interest.
• Platform improvement: Analysing aggregated usage data to improve game offerings, platform performance, and user experience. Lawful basis: legitimate interest.
• Marketing communications: Sending promotional emails, SMS, or notifications about bonuses, new games, and offers — only where you have opted in. Lawful basis: consent.
• Legal compliance: Meeting our obligations under applicable law, including responding to lawful requests from regulatory or law enforcement authorities. Lawful basis: legal obligation.

Section 5

Cookies and Tracking Technologies

hgxy uses cookies and similar tracking technologies on the platform. Cookies are small data files placed on your device when you visit the platform. They help us keep you logged in, remember your preferences, and understand how you use the site. The main categories of cookies we use are:

• Strictly necessary cookies: Essential for the operation of the platform. These cannot be disabled as the platform would not function without them. They include session management, login authentication, and security tokens.
• Functional cookies: Remember your preferences such as language settings, preferred game lobby view, and notification settings. Disabling these cookies may affect your experience.
• Analytical cookies: Help us understand how players navigate the platform so we can improve its performance and layout. Data collected is aggregated and anonymised where possible.
• Marketing cookies: Used to track the effectiveness of our promotional campaigns. These are only set where you have consented to marketing communications.

You can manage cookie preferences through your browser settings. Please note that disabling non-essential cookies may limit some platform functionality. We do not use third-party advertising network cookies that track your activity across other websites.

Section 6

Sharing Your Data

hgxy does not sell your personal data. We may share your data with carefully selected third parties only in the following circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, BRAC Bank, and other payment partners receive the minimum financial data necessary to process your transactions securely.
• Identity verification providers: KYC and AML screening partners receive identity documents and data points necessary to fulfil our verification obligations.
• Game content providers: Where a game is delivered by a third-party provider (e.g., Pragmatic Play, Evolution Gaming, Spribe, Ezugi), limited technical session data may be shared with that provider to facilitate game delivery and fair-play auditing.
• Legal and regulatory authorities: We may disclose personal data to law enforcement, regulatory bodies, or courts where required by applicable law or in response to a lawful request.
• Professional advisers: Legal counsel, auditors, and compliance consultants who are bound by professional confidentiality obligations.

All third-party service providers who process personal data on behalf of hgxy are bound by data processing agreements that require them to process data only on our documented instructions, to maintain adequate security measures, and to comply with applicable data protection law.

Section 7

International Data Transfers

hgxy is operated for the Bangladesh market. Some of our third-party service providers — including game studios, KYC verification agencies, and cloud infrastructure providers — may process personal data in countries outside Bangladesh. Where data is transferred internationally, hgxy takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable Bangladeshi law.

Safeguards for international data transfers may include standard contractual clauses, adequacy decisions, or binding corporate rules as applicable to the specific transfer. If you wish to obtain details of the safeguards applied to a specific international data transfer, please contact us at [email protected].

Section 8

Data Security

hgxy implements a comprehensive set of technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• SSL/TLS encryption for all data in transit between your browser and our servers.
• AES-256 encryption for sensitive data stored at rest on our servers.
• Role-based access controls ensuring that only authorised personnel can access personal data, strictly on a need-to-know basis.
• Multi-factor authentication for all internal administrative access to systems holding personal data.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Incident response procedures with defined escalation paths and notification timelines in the event of a data breach.
• Staff training on data protection and information security obligations.

While we apply robust security measures, no data transmission over the internet or electronic storage system can be guaranteed to be completely secure. In the event of a material data breach affecting your personal data, hgxy will notify affected users promptly and take all reasonable steps to mitigate harm.

Section 9

Data Retention

hgxy retains personal data for as long as necessary to fulfil the purpose for which it was collected, including to satisfy legal, accounting, or reporting requirements. The following general retention periods apply:

• Active account data: Retained for the full duration of your account and for a period of five (5) years following account closure, as required for AML and financial compliance purposes.
• Transaction and financial records: Retained for seven (7) years from the date of the transaction in accordance with standard financial record-keeping requirements.
• KYC documents: Retained for five (5) years from the date of verification or account closure, whichever is later.
• Support and communication records: Retained for three (3) years from the date of the interaction unless the record relates to an ongoing dispute or legal matter.
• Marketing consent records: Retained until consent is withdrawn and for one (1) year thereafter as evidence of the consent history.
• Technical and log data: Retained for up to twelve (12) months for security monitoring and fraud detection purposes, then deleted.

Where personal data is no longer required, it is securely deleted using industry-standard data destruction methods, or anonymised in such a way that re-identification is not possible. Anonymised data may be retained for statistical and analytical purposes indefinitely.

Section 10

Your Rights

Subject to applicable law, you have the following rights in respect of your personal data held by hgxy:

• Right of access: To obtain a copy of the personal data hgxy holds about you and information about how it is processed.
• Right to rectification: To have inaccurate or incomplete personal data corrected or completed without undue delay.
• Right to erasure ("right to be forgotten"): To request deletion of your personal data where it is no longer necessary, where consent has been withdrawn, or where processing is unlawful — subject to our legal retention obligations.
• Right to restriction of processing: To request that we limit how we use your data in certain circumstances, for example while a complaint is being investigated.
• Right to data portability: To receive personal data you have provided to us in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to object: To object at any time to processing of your personal data for direct marketing purposes. You also have the right to object to processing based on legitimate interest, although this right may be overridden in certain circumstances.
• Right to withdraw consent: Where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request – [Right Type]". We will respond within 30 calendar days. We may require identity verification before processing a data rights request to protect you against unauthorised third-party requests.

Section 11

Marketing Communications

hgxy will only send you direct marketing communications where you have opted in to receive them. Marketing communications may include information about new games, promotional bonuses, seasonal offers, and platform updates. We use the following channels for marketing where consent has been provided:

• Email newsletters and promotional messages sent to your registered email address.
• SMS notifications sent to your registered mobile number.
• In-platform notifications displayed within your account dashboard.

You may withdraw your consent to marketing communications at any time by updating your notification preferences in your account settings, or by contacting us at [email protected] with the subject line "Marketing Opt-Out". Opt-out requests are processed within 5 business days. Please note that withdrawing marketing consent does not affect transactional communications such as deposit confirmations, withdrawal notifications, and security alerts, which are sent as part of our contractual obligations to you regardless of marketing preference.

Section 12

Children and Minors

The hgxy platform is strictly intended for adults aged 21 and above. hgxy does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of our mandatory KYC process at registration and prior to first withdrawal.

If we become aware that personal data has been collected from a person under the age of 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated account. If you have reason to believe that a minor has registered an account on the hgxy platform, please notify us immediately at [email protected].

Section 13

Third-Party Links

The hgxy platform may contain references to third-party game providers and payment partners. Where you interact with third-party services integrated into the platform (such as a game studio's RNG-certified game engine or a payment gateway), your interaction with that third party is governed by their own privacy policy. hgxy is not responsible for the privacy practices of third-party services and encourages you to review the privacy policies of any third party whose services you use in connection with the platform.

hgxy does not include outbound links to unrelated external websites within the platform, and we do not share your data with third parties for the purpose of enabling third-party advertising on external sites.

Section 14

Changes to This Policy

hgxy reserves the right to update or amend this Privacy Policy at any time. When we make material changes to this Policy, we will notify you by posting the updated Policy on this page with a revised "Last updated" date, and where appropriate, by sending a notification to your registered email address.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data. Your continued use of the hgxy platform following the posting of changes to this Policy constitutes your acceptance of those changes. If you do not agree with a revised Policy, you should discontinue use of the platform and contact us to request account closure.

Section 15

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way hgxy handles your personal data, please contact our data team using the details below:

• Email: [email protected] (Subject line: "Privacy Enquiry")
• Live Chat: Available 24/7 from your account dashboard
• Response time: We aim to acknowledge all privacy enquiries within 5 business days (Bangladesh Standard Time, UTC+6) and to provide a full response within 30 calendar days.

hgxy is committed to resolving all data-related concerns fairly and transparently. If you are dissatisfied with our response, you may have the right to escalate your complaint to a relevant supervisory authority under applicable law.