Privacy Policy — hellspin

1 Data Controller & Scope

This Privacy Policy applies to all personal data collected, processed, and stored by hellspin (the "Platform", "we", "us", or "our") in connection with your use of the hellspin website and all associated products and services, including the sportsbook, live casino, slots, fishing games, virtual sports, and customer support channels.

hellspin acts as the data controller in respect of the personal data you provide to us directly and the data we collect automatically during your use of the platform. As data controller, hellspin is responsible for determining the purposes and means of processing your personal data in compliance with applicable data protection principles.

This policy does not apply to third-party websites, payment processors, or game studio platforms that may be linked to or integrated with hellspin. Those entities operate under their own independent privacy policies, and we encourage you to review them separately.

2 Personal Data We Collect

hellspin collects personal data from you in three principal ways: data you provide directly during registration and account use, data collected automatically through your use of the Platform, and data received from third parties in connection with payment processing and identity verification.

2.1 Data You Provide Directly

• Registration Data: Full legal name, date of birth, gender, email address, mobile phone number, and residential address (including city, district, and postal code).
• KYC Verification Documents: Copies of government-issued photo identification (National ID Card, passport, or driving licence), proof of address documents, and proof of payment method ownership.
• Financial Data: bKash account number, Nagad account number, Rocket account number, Upay account number, bank account details, and Visa/Mastercard details as applicable. hellspin does not store full card numbers — payment data is tokenised by our certified payment processor.
• Communication Data: Messages, complaints, and queries submitted via live chat, email (support@hellspin), or any other support channel.
• Promotional Preferences: Bonus opt-in selections, marketing communication preferences, and any survey or feedback responses you submit voluntarily.

2.2 Data Collected Automatically

• Device & Technical Data: IP address, browser type and version, operating system, device type (mobile/desktop/tablet), screen resolution, and device identifiers.
• Usage Data: Pages visited, games played, bet history, session duration, click paths, search queries made within the Platform, and feature interactions.
• Location Data: Approximate geographic location derived from your IP address. hellspin does not collect precise GPS-level location data from your device.
• Cookie Data: Session identifiers, authentication tokens, and analytics identifiers stored via cookies and similar technologies. See Section 6 for full cookie details.

2.3 Data Received from Third Parties

• Payment Processors: Transaction confirmation data, payment status updates, and fraud risk signals from bKash, Nagad, Rocket, Upay, and card processing partners.
• Identity Verification Services: Verification status results from KYC and AML screening providers used to comply with applicable financial crime prevention obligations.
• Fraud Prevention Partners: Device fingerprinting and behavioural risk scores from certified fraud detection platforms used to protect the integrity of the hellspin Platform.

3 Legal Basis for Processing

hellspin processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing that is required to fulfil the contract between you and hellspin — including account creation, processing deposits and withdrawals, resolving disputes, and delivering the products and services you have requested.
• Legal Obligation: Processing required to comply with applicable legal requirements, including anti-money laundering (AML) obligations, identity verification duties, and financial record-keeping requirements.
• Legitimate Interests: Processing that is necessary for the legitimate interests of hellspin, provided those interests are not overridden by your data protection rights. This includes fraud prevention, platform security, improving service quality, and responsible gambling monitoring.
• Consent: Where we rely on your consent to send marketing communications, set non-essential cookies, or process data for purposes beyond those listed above. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4 How We Use Your Data

hellspin uses the personal data we collect for the following purposes:

• Account Management: Creating and maintaining your player account, verifying your identity, processing your KYC documentation, and managing your account settings and preferences.
• Transaction Processing: Processing deposits via bKash, Nagad, Rocket, Upay, and bank transfer; processing withdrawals to your registered payment method; maintaining accurate financial records of all transactions.
• Platform Delivery: Providing access to sportsbook markets, live casino games, slots, fishing games, and all other Platform features. Ensuring game results and betting outcomes are accurately recorded and credited.
• Customer Support: Responding to your queries, complaints, and dispute submissions via live chat and email. Maintaining records of support interactions to ensure consistent and fair resolution of issues.
• Responsible Gaming: Monitoring account activity for signs of problem gambling behaviour, administering deposit limits, loss limits, time-out periods, and self-exclusion requests, and contacting players where responsible gaming concerns are identified.
• Fraud Prevention & Security: Detecting and preventing fraudulent activity, multiple account registrations, bonus abuse, money laundering, and other prohibited conduct. Sharing risk signals with certified fraud prevention partners where required.
• Legal & Regulatory Compliance: Fulfilling AML screening, sanctions screening, and financial record-keeping obligations. Responding to lawful requests from competent authorities.
• Platform Improvement: Analysing aggregated usage data to improve the design, performance, and feature set of the hellspin Platform. Conducting A/B testing and user experience research using anonymised data sets.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. hellspin does not send unsolicited marketing to players who have not opted in or who have subsequently opted out.

5 Data Sharing & Third Parties

hellspin does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We share your personal data only in the following limited and controlled circumstances:

5.1 Service Providers

We share personal data with carefully selected third-party service providers who assist us in operating the Platform. These include payment processors (bKash, Nagad, Rocket, Upay, bank partners, Visa/Mastercard acquirers), identity verification and KYC providers, fraud detection and risk management platforms, cloud hosting and data storage providers, and customer support tooling providers. All service providers are bound by data processing agreements requiring them to process your data only on our instructions and to maintain appropriate technical and organisational security measures.

5.2 Game Studio Partners

When you play games from third-party studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, Spribe, Hacksaw Gaming, Red Tiger, and Play'n GO), limited technical data (such as your player ID, session token, and game round identifiers) is shared with the relevant studio to facilitate gameplay, resolve disputes, and generate round history records. This data sharing is the minimum necessary for game delivery and is governed by our contracts with each game provider.

5.3 Legal & Regulatory Authorities

hellspin may disclose your personal data to law enforcement agencies, regulatory authorities, or other competent bodies where required to do so by applicable law, court order, or regulatory request. We will only disclose the minimum amount of data required to comply with such obligations and will notify you of any such disclosure where we are legally permitted to do so.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of hellspin's business, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer via the email address registered on your account, and the acquiring entity will be required to honour the terms of this Privacy Policy.

6 Cookies & Tracking Technologies

hellspin uses cookies and similar tracking technologies (such as local storage objects and session tokens) to operate the Platform efficiently, maintain your logged-in session, and gather analytics data to improve platform performance. The following categories of cookies are used:

hellspin does not use third-party advertising cookies or cross-site retargeting pixels. You may manage cookie preferences through your browser settings; however, disabling essential or authentication cookies may impair your ability to log in and use the Platform.

7 Data Retention Periods

hellspin retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, and to resolve disputes or enforce our agreements. The key retention periods applied by hellspin are set out in the table in Section 2 above.

Upon expiry of the applicable retention period, personal data is either securely deleted from our systems or anonymised so that it can no longer be attributed to an identifiable individual. KYC documents and financial transaction records are retained for a minimum of five to seven years from the date of the last transaction in order to comply with anti-money laundering obligations applicable to financial service platforms operating in the Bangladesh market.

Where you request the deletion of your personal data (see Section 9 — Your Data Rights), hellspin will process your request within 30 days. We may retain a minimum data set beyond your deletion request where retention is required by law or is necessary to defend against pending or threatened legal claims.

8 Data Security Measures

hellspin implements a comprehensive set of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• SSL/TLS Encryption: All data transmitted between your device and hellspin's servers is encrypted using TLS 1.2 or higher. Our SSL certificate is renewed and validated continuously.
• Data-at-Rest Encryption: Sensitive personal data stored in our databases — including KYC documents, financial records, and authentication credentials — is encrypted at rest using AES-256 encryption.
• Password Security: Player passwords are stored as salted cryptographic hashes. hellspin staff cannot view your plaintext password. If you forget your password, a secure reset link is issued to your registered email address.
• Access Controls: Access to personal data within hellspin is restricted on a strict need-to-know basis. All internal access is logged and subject to periodic audit review.
• Payment Tokenisation: Card payment data is tokenised by our certified payment processor. hellspin does not store full card numbers, CVV codes, or card expiry dates on its own servers.
• Fraud Detection Systems: Real-time automated monitoring detects suspicious login activity, unusual transaction patterns, and potential account compromise events, triggering alerts and protective account restrictions where required.
• Security Incident Response: In the event of a data security incident that affects your personal data, hellspin will notify affected players via their registered email address as promptly as possible and take all reasonable steps to contain and remediate the incident.

While hellspin takes all reasonable precautions to protect your data, no internet-based platform can guarantee absolute security. You also play a role in keeping your account secure by using a strong, unique password, enabling any available two-factor authentication, and contacting support@hellspin immediately if you suspect unauthorised access to your account.

9 Your Data Rights

As a player on hellspin, you hold the following rights in relation to your personal data. To exercise any of these rights, submit a written request to support@hellspin with the subject line "Data Rights Request" and include your registered account email address for identification purposes. hellspin will respond to all valid data rights requests within 30 days.

10 Children's Privacy

If hellspin becomes aware that personal data has been collected from an individual who is under 18 years of age, we will immediately suspend the relevant account, void any associated balances, and securely delete the personal data in question. If you believe that a minor has registered on hellspin, please report this immediately to support@hellspin so that we can take prompt action.

hellspin employs age verification controls at the point of registration and as part of its KYC process. Any player who provides false date-of-birth information to circumvent these controls will have their account permanently closed and any winnings forfeited.

11 Policy Updates

hellspin reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or the products and services we offer. The effective date at the top of this document will be updated whenever a material change is made.

Where changes to this Privacy Policy are material — meaning they significantly affect how we collect, use, or share your personal data — hellspin will notify registered players via the email address on file at least 14 days prior to the changes taking effect. Continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.

We encourage you to review this Privacy Policy periodically to stay informed about how hellspin is protecting your personal information. The most current version of this policy is always available at hellspin/privacy-policy.

12 Contact & Complaints

12.1 Data Rights & Privacy Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by hellspin, please contact our support team:

• Email: support@hellspin — Subject line: "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 via the hellspin platform interface
• Response Time: Within 30 days for formal data rights requests; within 4 hours for general privacy enquiries via email; under 2 minutes via live chat

12.2 Complaints

If you are not satisfied with hellspin's response to a privacy concern or data rights request, you may escalate your complaint by submitting a formal written complaint to support@hellspin with the subject line "Formal Privacy Complaint". hellspin will issue a written final response within 14 business days of receipt.