hy77 Privacy Policy — How We Collect, Use, and Protect Your Data

1 Who We Are

hy77 is an online betting and casino platform operating at hy77.io, providing sports betting, casino games, live dealer products, and related digital entertainment services to registered users in Bangladesh and other permitted markets. For the purposes of this Privacy Policy, hy77 acts as the data controller responsible for all personal data collected through the hy77.io platform. As data controller, hy77 determines the purposes and means by which your personal data is processed.

All data protection enquiries, access requests, erasure requests, and privacy-related complaints should be directed to the hy77 support team using the contact details provided in Section 13 of this Policy. hy77 is committed to handling all such requests promptly, professionally, and in accordance with this Privacy Policy.

2 Data We Collect

hy77 collects personal data through several channels: directly from you when you register an account or interact with the platform, automatically when you use our services, and from third-party sources such as payment providers and identity verification services. The categories of personal data we collect are described below.

2.1 — Registration and Account Data

• Full legal name as it appears on your government-issued identity document.
• Date of birth — collected for mandatory age verification to confirm you are at least 21 years of age.
• Mobile phone number — used as your primary account identifier and for security notifications.
• Email address — used for account correspondence, transaction confirmations, and where you have consented, promotional communications.
• Username and hashed password — your chosen login credentials. Passwords are stored as a one-way cryptographic hash and are never accessible in plain text by hy77 staff.
• Residential address — collected during identity verification and required for certain withdrawal processing workflows.

2.2 — Identity Verification Data

• National ID card, passport, or birth certificate — scanned copies or photographs submitted to verify your identity and confirm your age and address.
• Selfie or live facial verification image — collected where our identity verification process requires a biometric likeness check against your submitted identity document.
• Proof of address documentation — such as a utility bill, bank statement, or mobile financial service statement issued within the last three months.

2.3 — Financial and Transaction Data

• Deposit and withdrawal records — including amounts, timestamps, payment method used (bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank), and transaction reference numbers.
• Account balance history — a record of your hy77 wallet balance over time.
• Bonus and promotion history — details of all promotional offers credited to your account and the associated wagering activity.
• Mobile financial service account details — such as the bKash or Nagad account number associated with your hy77 withdrawals, collected to facilitate payment processing.

2.4 — Gaming and Betting Activity Data

• Bet history — a full record of all wagers placed on the hy77 platform, including market, stake, odds, and settlement outcome.
• Casino game session data — including games played, session duration, bet sizes, and win/loss outcomes.
• Responsible gaming settings — including any deposit limits, session time limits, cooling-off periods, or self-exclusion requests you have applied to your account.

2.5 — Technical and Usage Data

• IP address — collected at login, registration, and during active sessions for security monitoring and fraud prevention purposes.
• Device information — including device type, operating system version, browser type and version, and screen resolution.
• Session logs — timestamps of login and logout events, pages visited, features used, and session duration.
• Cookies and similar tracking technologies — as described in Section 6 of this Policy.

2.6 — Communications Data

• Live chat transcripts — records of all conversations between you and hy77 customer support agents, retained for quality assurance and dispute resolution purposes.
• Email correspondence — records of email exchanges between you and the hy77 support team.
• Customer support ticket history — details of all support requests you have submitted and their resolution status.

3 How We Use Your Data

hy77 uses the personal data it collects for the following defined purposes only. We do not process your personal data for purposes incompatible with those listed here without first obtaining your explicit consent.

Purpose	Data Categories Used
Account registration and management — creating and maintaining your hy77 account, enabling login, and managing account settings.	Registration data, technical data
Identity verification and age checks — confirming that you are who you say you are and that you are at least 21 years of age.	Registration data, verification data
Payment processing — facilitating deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and Dutch-Bangla Bank.	Financial data, verification data
Providing betting and casino services — enabling you to place bets, play casino games, and access all features of the hy77 platform.	Gaming data, financial data
Fraud prevention and security — detecting and preventing unauthorised access, money laundering, bonus abuse, and other prohibited conduct.	All categories as relevant
Responsible gaming compliance — monitoring gaming patterns to identify potential problem gambling behaviour and applying account-level protections where appropriate.	Gaming data, registration data
Customer support — responding to your enquiries, resolving disputes, and managing your account requests.	Communications data, registration data
Legal and regulatory compliance — meeting our obligations under applicable laws, including financial record-keeping and anti-money-laundering requirements.	Financial data, verification data
Platform improvement — analysing aggregated, anonymised usage data to improve the performance, design, and content of the hy77 platform.	Technical data, gaming data (anonymised)
Marketing communications — sending you promotional offers, bonus notifications, and platform updates where you have given your explicit consent to receive such communications.	Registration data, gaming data (for personalisation)

4 Legal Basis for Processing

hy77 processes your personal data on the following legal bases, depending on the specific purpose for which the data is being used:

• Contractual necessity: Processing that is necessary to perform our contractual obligations to you under the hy77 Terms and Conditions — including account management, payment processing, and service delivery.
• Legal obligation: Processing that is required to comply with applicable laws and regulations, including identity verification, anti-money-laundering checks, and financial record-keeping obligations.
• Legitimate interests: Processing carried out for hy77's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics — provided those interests are not overridden by your fundamental privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing and promotional communications. You may withdraw consent at any time by contacting our support team, without affecting the lawfulness of any processing carried out prior to withdrawal.

5 Data Sharing and Disclosure

hy77 does not sell your personal data. We may share your data with the following categories of third parties only where necessary to provide our services, comply with legal obligations, or protect the legitimate interests of hy77 and its users:

• Payment processing partners — including bKash, Nagad, Rocket, Upay, Visa, Mastercard, and Dutch-Bangla Bank — receive the minimum financial data necessary to process your deposit or withdrawal transaction. These providers operate under their own privacy policies and data protection obligations.
• Identity verification service providers — third-party KYC (Know Your Customer) providers may receive your identity and verification documents to perform automated or manual identity checks on hy77's behalf. These providers are bound by contractual data processing agreements with hy77.
• Game content providers — studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may receive session identifiers and anonymised player data necessary to deliver their game content on the hy77 platform. Full personal identifiers are not shared with game studios.
• Fraud prevention and security services — specialised third-party providers that assist hy77 in identifying and preventing fraudulent account activity, collusive behaviour, and money laundering. These providers receive only the data necessary for their specific function.
• Legal and regulatory authorities — hy77 will disclose personal data to law enforcement agencies, financial intelligence units, or other governmental authorities where required to do so by applicable law, court order, or regulatory directive. hy77 will notify affected users of such disclosure where legally permitted to do so.
• Corporate successors — in the event of a merger, acquisition, or sale of all or substantially all of the assets of hy77, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and of any material changes to this Privacy Policy that result from it.

In all cases where hy77 shares personal data with third parties, we apply contractual safeguards to ensure that those parties process your data only for specified, limited purposes and in accordance with standards consistent with this Privacy Policy.

6 Cookies and Tracking Technologies

hy77 uses cookies and similar tracking technologies on the hy77.io platform. Cookies are small text files placed on your device by the platform that allow hy77 to recognise your browser across sessions, maintain your logged-in state, and collect usage analytics data. The following categories of cookies are used on hy77.io:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during an active session and security tokens that protect against cross-site request forgery attacks. These cookies cannot be disabled without impairing core platform functionality.
• Performance and analytics cookies: Used to collect anonymised data about how users interact with the hy77 platform — including pages visited, session duration, and navigation paths. This data is used solely to improve the platform's performance and user experience.
• Functional cookies: Used to remember your preferences and settings, such as your preferred language, display settings, or responsible gaming reminders, so that you do not need to reconfigure them on each visit.
• Fraud prevention cookies: Used to assign a persistent device fingerprint that helps hy77 detect and prevent fraudulent activity, including multiple account creation and unauthorised account access attempts.

hy77 does not use third-party advertising cookies or behavioural retargeting technologies. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent you from logging in to the hy77 platform.

7 Data Retention

hy77 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following retention periods apply as a general guide:

• Account and registration data: Retained for the duration of your active account relationship with hy77, plus a minimum of five (5) years following account closure, to meet financial record-keeping and anti-money-laundering compliance requirements.
• Identity verification documents: Retained for a minimum of five (5) years following account closure in accordance with applicable KYC and AML regulations. Biometric verification images are deleted within 90 days of the verification process being completed, unless a regulatory requirement mandates longer retention.
• Financial transaction records: Retained for a minimum of seven (7) years following each transaction date, in accordance with standard financial record-keeping obligations.
• Gaming and betting history: Retained for the duration of your active account plus five (5) years following account closure, for dispute resolution and regulatory audit purposes.
• Customer support communications: Retained for three (3) years from the date of the most recent communication in each support case, for quality assurance and dispute resolution purposes.
• Technical and session data: Retained for a rolling period of thirteen (13) months, after which it is aggregated and anonymised or permanently deleted.
• Marketing consent records: Retained for as long as you remain an active hy77 account holder, or until you withdraw your consent, whichever is earlier. Records of consent withdrawal are retained for three (3) years as evidence of compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where anonymisation is not technically feasible, the data is archived in a restricted-access environment and no longer used for any active processing purpose.

8 Your Data Rights

As a user of the hy77 platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact the hy77 support team at [email protected]. We will acknowledge your request within five (5) business days and respond substantively within a reasonable timeframe.

• Right of access: You have the right to request a copy of all personal data hy77 holds about you, along with information about how it is being processed. We will provide this in a structured, commonly used format.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data hy77 holds about you. For account details such as your mobile number or address, you may also update these directly through your account settings or by contacting support.
• Right to erasure: Subject to our legal retention obligations, you have the right to request deletion of your personal data. Note that financial transaction records, identity verification documents, and certain other data must be retained for regulatory compliance purposes and cannot be erased on request.
• Right to restriction of processing: You have the right to request that hy77 restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to data portability: Where processing is based on your consent or on a contractual relationship and is carried out by automated means, you have the right to receive your personal data in a machine-readable format suitable for transfer to another service provider.
• Right to object: You have the right to object to the processing of your personal data where that processing is based on hy77's legitimate interests. hy77 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your consent (such as for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

9 Data Security Measures

hy77 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption on all data transmitted between your browser or device and the hy77.io platform.
• One-way cryptographic hashing of all account passwords using a modern, computationally expensive hashing algorithm. hy77 staff cannot retrieve your password in plain text.
• Role-based access controls limiting internal staff access to personal data to only those employees and contractors whose job functions require it.
• Regular security audits and penetration testing conducted by qualified information security professionals to identify and remediate potential vulnerabilities in the hy77 platform infrastructure.
• Intrusion detection and anomaly monitoring systems that alert the hy77 security team to unusual access patterns, potential brute-force attacks, or other indicators of compromise in real time.
• Secure data centre infrastructure with physical access controls, environmental protections, and redundant backup systems to protect against hardware failure and data loss.

While hy77 takes every reasonable precaution to protect your personal data, no online platform can guarantee absolute security against all possible threats. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, hy77 will notify affected users without undue delay and in accordance with applicable legal obligations.

10 Third-Party Links

The hy77 platform may display references to third-party brands, payment service providers, and game studios. Where the hy77 platform provides a link to an external website or service, please be aware that hy77 has no control over the privacy practices or content of those external sites. This Privacy Policy applies solely to data collected through the hy77.io platform and does not extend to any third-party website you may navigate to from hy77.io. We encourage you to read the privacy policy of any third-party service you use in connection with your hy77 account, including bKash, Nagad, Rocket, and Upay.

11 Children and Minors

The hy77 platform is strictly intended for users aged 21 and above. hy77 does not knowingly collect personal data from individuals under the age of 21. If hy77 becomes aware that personal data has been collected from a user who is under 21 years of age, that account will be immediately suspended, all associated data will be securely deleted to the extent permitted by applicable law, and any funds in the account will be handled in accordance with our Terms and Conditions regarding underage accounts.

If you believe that a minor has registered an account on the hy77 platform, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action without delay.

12 Changes to This Privacy Policy

hy77 reserves the right to update or replace this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable legal obligations. When a material change is made to this Policy, hy77 will notify registered users via the mobile number or email address associated with their account, or via a prominent notice displayed upon login to the platform. The effective date shown at the top of this document will be updated whenever a new version of the Privacy Policy is published.

Continued use of the hy77 platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not accept the revised Policy, you must cease using the hy77 platform and contact our support team to request account closure. It is your responsibility to review this Policy periodically to remain informed of any changes.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way hy77 handles your personal data, please contact our support team using the details below. Our team is available 24 hours a day, 7 days a week, and will respond to all privacy-related enquiries in English.

• Email: [email protected] — for data access requests, erasure requests, and privacy complaints. Please include your registered account username and a brief description of your request.
• Live Chat: Available directly on the hy77.io platform. Average response time is 2–5 minutes. Live chat support is available in both English and Bengali.
• Response Timeframe: hy77 will acknowledge all privacy-related requests within five (5) business days and will aim to provide a full substantive response within thirty (30) calendar days of receipt.

hy77 treats all privacy enquiries with the highest priority. Where a request involves the erasure, correction, or export of your personal data, our support team will guide you through the process and confirm completion in writing once the action has been taken.