gbaje Privacy Policy — How We Handle Your Data

gbaje collects personal data that you provide directly to us, as well as data generated automatically through your use of the platform. The categories of personal data we collect include:

• Identity data: full name, date of birth, and government-issued identification number (collected during KYC verification).
• Contact data: mobile phone number and email address used to register or communicate with gbaje.
• Financial data: payment method details (e.g. bKash account number, Nagad number, bank account reference), transaction history, and deposit and withdrawal records.
• Technical data: IP address, device type, browser type and version, operating system, session timestamps, and pages visited on the gbaje platform.
• Usage data: betting and gaming activity, game preferences, session duration, bonus usage, and any communications exchanged with gbaje customer support.

gbaje uses the personal data it collects for the following lawful purposes:

• Account management: to create, maintain, verify and secure your gbaje account, including identity and age verification in compliance with our 21+ policy.
• Payment processing: to process your deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay and supported bank transfers, and to maintain accurate financial records.
• Platform improvement: to analyse usage patterns, improve platform performance, personalise your experience, and develop new features and services.
• Legal and compliance obligations: to detect and prevent fraud, money laundering and other prohibited activities, and to comply with applicable legal and regulatory requirements.

gbaje processes your personal data on the following legal bases:

• Contractual necessity: processing is required to perform the contract between you and gbaje, including account registration, accepting bets, and processing payments.
• Legal obligation: certain processing is required by law, including KYC, anti-money laundering checks, and responsible gaming compliance measures such as age verification.
• Legitimate interests: gbaje may process certain technical and usage data for fraud prevention, security monitoring and platform improvement, where this does not override your fundamental rights.

gbaje does not sell, rent or trade your personal data to third parties for their own marketing or commercial purposes. gbaje may share your personal data with carefully selected third parties only in the following circumstances:

• Payment processors: gbaje shares necessary financial data with payment providers (bKash, Nagad, Rocket, Upay, and banking partners) solely to process your deposits and withdrawals in BDT.
• Game and platform providers: game studios (including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming and Spribe) may receive session and technical data required to deliver their games on the gbaje platform.
• Fraud prevention and security partners: gbaje may share technical data with fraud detection and identity verification services as part of its platform security obligations.
• Legal and regulatory authorities: gbaje will disclose personal data to competent authorities where required by applicable law or a valid legal order.

gbaje retains your personal data for as long as your account remains active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements. Financial records and transaction data are retained for a minimum of six years following the closure of your account, in accordance with standard financial record-keeping obligations. Where you request deletion of your account and data, gbaje will action that request within a reasonable timeframe subject to any overriding legal retention obligations. Data that is no longer required will be securely deleted or anonymised.

As a gbaje player, you have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data gbaje holds about you at any time by contacting [email protected].
• Right of rectification: if any personal data held by gbaje about you is inaccurate or incomplete, you may request that it be corrected.
• Right to erasure: you may request deletion of your personal data, subject to any overriding legal or contractual retention obligations gbaje is required to comply with.
• Right to restriction: you may request that gbaje restricts processing of your personal data in certain circumstances, for example where you contest the accuracy of the data.
• Right to object: you may object to gbaje processing your data on the basis of legitimate interests. gbaje will consider your objection and cease processing unless it has compelling legitimate grounds to continue.

gbaje takes the security of your personal data seriously. The platform employs SSL (Secure Sockets Layer) encryption to protect all data transmissions between your device and our servers. Access to personal data within gbaje is restricted to authorised personnel who require it to carry out their responsibilities, and is governed by strict internal access control policies. gbaje maintains security procedures designed to protect against unauthorised access, disclosure, alteration, or destruction of personal data. While gbaje takes all reasonable steps to protect your data, no online security system is entirely infallible. In the unlikely event of a data breach that poses a risk to your rights and freedoms, gbaje will take prompt steps to notify affected players and to mitigate any harm, in accordance with applicable law.

The gbaje platform may use service providers whose infrastructure is located in jurisdictions outside Bangladesh. Where personal data is transferred outside of Bangladesh, gbaje will take reasonable steps to ensure that appropriate protections are in place to safeguard your data, consistent with this Policy. Such safeguards may include:

• Contractual clauses requiring the receiving party to maintain data protection standards equivalent to those applied by gbaje.
• Due diligence assessments of third-party service providers before any personal data is shared with them.
• Limiting data transfers to the minimum necessary for the purposes stated in this Policy.

gbaje may send you promotional communications about bonuses, new games, seasonal offers (for example during BPL season, Eid or Pohela Boishakh), and platform updates, provided you have not opted out of such communications. You may opt out of marketing communications at any time by contacting [email protected] and requesting removal from our promotional mailing list. Opting out of marketing communications will not affect your ability to receive important account-related communications such as transaction confirmations, security alerts, or policy updates, which are sent as a necessary part of the gbaje service and cannot be unsubscribed from while your account is active.

The gbaje platform is strictly for adults aged 21 and above. gbaje does not knowingly collect personal data from individuals under the age of 21. If gbaje becomes aware that personal data has been collected from a person under 21, that data will be deleted promptly and the associated account will be closed. If you believe a person under the age of 21 has registered an account with gbaje, please notify us immediately at [email protected] so that appropriate action can be taken.

gbaje reserves the right to update or amend this Privacy Policy at any time. Where changes are material, gbaje will notify registered players via email or an in-platform notification before the updated Policy takes effect. The effective date at the top of this page will be updated to reflect the date of the most recent revision. Your continued use of the gbaje platform following the publication of a revised Policy constitutes your acceptance of the changes. If you do not agree with any updates to this Policy, you should cease using the gbaje platform and may request account closure by contacting [email protected].