Privacy Policy — How gbajr Protects Your Data

gbajr ("we", "us", "our") is the data controller responsible for personal data collected through gbajr.org and all associated services. gbajr operates as an online entertainment platform providing casino games, sports betting, and crash game services to adults aged 21 and above in Bangladesh. For all data protection matters, contact us at [email protected]. References to "you" or "user" in this Privacy Policy mean any individual who accesses, registers on, or uses any part of the gbajr platform.

gbajr collects personal data directly from you when you register and use the platform, automatically from your device when you access the platform, and in some cases from third-party identity verification and payment service providers. The categories of data we collect include:

• Identity data: full name, date of birth, National Identity Card number, and photograph (where submitted for KYC verification).
• Contact data: mobile phone number (used as your primary account identifier and for OTP verification), and email address where provided.
• Financial data: bKash, Nagad, Rocket, or Upay account numbers; bank account details where used; and transaction history including deposit and withdrawal amounts with timestamps.
• Technical data: IP address, device type and model, operating system, browser type, screen resolution, session duration, and page-view data within the platform.
• Gaming data: game session logs, bet amounts and outcomes, sports market selections, free spin usage, bonus activation records, and responsible gaming tool usage such as deposit limits and self-exclusion requests.
• Communications data: records of your customer support interactions with gbajr, including chat transcripts, support ticket content, and email correspondence.

gbajr does not collect sensitive categories of personal data such as racial origin, political opinions, religious beliefs, or health data, except where a government-issued identity document provided for KYC purposes incidentally contains such information. In that case it is processed solely for identity verification and is not retained beyond the minimum legally required period.

gbajr uses your personal data only for specific, legitimate purposes directly related to operating a safe and compliant online gaming platform for players in Bangladesh. The purposes for which we process your data are:

• Account creation and management: processing your registration, maintaining your account, verifying your identity, and enabling login and session authentication via OTP.
• Payment processing: executing deposit and withdrawal transactions via bKash, Nagad, Rocket, Upay, and Bangladeshi bank transfers; confirming completion; resolving payment disputes.
• Regulatory compliance: fulfilling our KYC, AML, and responsible gaming obligations under applicable law, including age verification and self-exclusion enforcement.
• Platform operation and improvement: monitoring performance, diagnosing technical issues, analysing usage patterns to improve user experience, and preventing fraud and abuse.
• Customer support: responding to your queries, complaints, and requests; and maintaining records of support interactions for quality assurance and dispute resolution.
• Promotional communications (where you have opted in): sending bonus notifications, promotion alerts, and seasonal offers via SMS to your registered mobile number.

gbajr processes your personal data on the following legal bases, depending on the purpose of the processing:

• Contractual necessity: processing required to perform our contract with you — including running your account, processing deposits and withdrawals, and delivering the games and betting services you use.
• Legal obligation: processing required to comply with applicable laws and regulatory requirements, including KYC identity verification, AML transaction monitoring, and age verification.
• Legitimate interests: processing for fraud prevention, platform security, abuse detection, and improving platform performance — activities necessary for gbajr to operate a trustworthy service.
• Consent: processing for optional promotional communications such as SMS bonus alerts and push notifications. This processing occurs only where you have actively opted in and ceases immediately upon withdrawal of consent.

gbajr does not sell your personal data. We share your data only with carefully selected third parties where strictly necessary to operate the platform or fulfil a legal obligation. The categories of recipients are:

• Payment service providers: bKash, Nagad, Rocket, Upay, and our banking partners receive the minimum transaction data needed to process your deposits and withdrawals. These providers operate under their own privacy policies and are independently regulated.
• Identity verification providers: third-party KYC service providers who assist with age and identity verification. They receive only the data necessary to perform the verification service and are bound by strict confidentiality obligations.
• Game and technology providers: providers such as Pragmatic Play, Evolution Gaming, Spribe, and Ezugi may receive session data necessary to deliver the game to your device. They do not receive your payment or KYC data.
• Law enforcement and regulatory authorities: where required by law, court order, or regulatory direction, gbajr will disclose data to the relevant authority. We will notify you of any such disclosure where legally permitted.

All third parties with whom gbajr shares personal data are required to implement appropriate security measures and to use the data only for the purposes for which it was shared. gbajr does not permit third parties to use your data for their own marketing purposes.

gbajr treats financial data with the highest level of sensitivity. Your bKash, Nagad, Rocket, or Upay numbers and bank account details are stored in encrypted form and accessed only by authorised personnel directly involved in payment processing or fraud investigation. gbajr does not store full mobile banking PINs. Payment processing uses secure, encrypted channels, and gbajr retains only the minimum transaction record data required for account management, dispute resolution, and AML compliance.

For withdrawals, gbajr applies OTP verification to your registered mobile number before processing any outgoing payment. This two-step verification ensures that no funds can leave your account without your active authentication. If you receive an OTP you did not request, contact [email protected] immediately to report potential unauthorised access.

gbajr uses cookies and similar tracking technologies on gbajr.org to enable core platform functionality, maintain your session state, and analyse how users interact with the site. The types of cookies we use are:

• Essential cookies: strictly necessary for the platform to function. These enable login session persistence, OTP workflow state, and payment gateway handoffs. These cannot be disabled without breaking core platform functionality.
• Analytics cookies: used to understand how players navigate the platform, which games are most visited, and where users encounter friction. Data is aggregated and anonymised and is used solely to improve gbajr's platform design and layout.
• Security cookies: used to detect and prevent fraudulent activity, bot traffic, and unusual session behaviour. These are part of gbajr's fraud prevention and platform integrity controls.

gbajr does not use third-party advertising cookies and does not share cookie data with advertising networks or data brokers. You can manage cookie preferences through your mobile browser settings; however, disabling essential cookies will impair your ability to use the gbajr platform.

gbajr retains your personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Account data and transaction records are retained for a minimum of 5 years from account closure or the last transaction date (whichever is later) to satisfy AML and financial record-keeping obligations. KYC identity documents are retained for the same minimum period. Gaming session logs are retained for 2 years for fraud investigation and responsible gaming audit purposes. Customer support communications are retained for 2 years from the date of the interaction.

Where personal data is no longer required and no legal hold applies, gbajr deletes or permanently anonymises the data using industry-standard secure deletion methods. Where anonymisation is used in preference to deletion, the resulting dataset contains no information that could identify you individually.

As a gbajr user, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days of receiving your request:

• Right of access: you may request a copy of the personal data gbajr holds about you, provided in a structured and commonly used format.
• Right to rectification: if any personal data we hold about you is inaccurate or incomplete, you may request that we correct or complete it. Account details such as your registered mobile number can also be updated through account settings.
• Right to erasure: you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Requests are reviewed within 30 days.
• Right to restrict processing: in certain circumstances you may request that we restrict processing of your personal data while a dispute or accuracy query is being resolved.
• Right to withdraw consent: where processing is based on your consent (for example, promotional SMS communications), you may withdraw that consent at any time through your account settings or by contacting [email protected]. Withdrawal does not affect the lawfulness of prior processing.

gbajr will not charge a fee for handling data rights requests unless a request is manifestly unfounded or excessive. In such cases we reserve the right to charge a reasonable administrative fee or to decline the request, providing written reasons.

gbajr implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our technical security measures include SSL/TLS encryption for all data in transit, AES-256 encryption for sensitive data at rest, multi-factor authentication for administrative access to player data systems, firewall and intrusion detection systems, and regular security assessments of our platform infrastructure.

Our organisational security measures include access controls limiting employee access to personal data on a strict need-to-know basis, regular staff training on data protection obligations, and a formal data breach response procedure. In the event of a breach likely to result in risk to your rights and freedoms, gbajr will notify affected players without undue delay and take immediate steps to contain and remediate the breach.

gbajr is strictly an adult platform. Our services are intended exclusively for individuals aged 21 and above. gbajr does not knowingly collect personal data from anyone under the age of 21. If gbajr becomes aware that personal data has been collected from a person under 21 — whether through age misrepresentation at registration or any other means — gbajr will immediately close the account, delete all associated personal data to the extent permitted by law, and reverse any financial transactions connected to the underage account. If you believe gbajr may have inadvertently collected data from a minor, notify us immediately at [email protected].

gbajr may send you bonus notifications, promotional offers, and seasonal event communications — such as BPL cricket season promotions or Eid special offers — via SMS to your registered mobile number, but only where you have provided explicit opt-in consent during registration or through your account settings. We do not send unsolicited marketing emails.

To stop receiving marketing SMS messages, you can: (a) update your notification preferences in your gbajr account settings; or (b) contact [email protected] with a written opt-out request. Opt-out requests are processed within 48 hours. Opting out of marketing communications does not affect transactional messages such as OTP codes, deposit confirmations, or withdrawal alerts, which are necessary for operating your account.

gbajr reviews and updates this Privacy Policy periodically to reflect changes in our data practices, legal obligations, and platform features. When material changes are made, we will post the updated policy on gbajr.org/privacy-policy with a revised last-updated date. Where changes are significant, we will also notify registered players via an in-app notification. Your continued use of the gbajr platform after any policy update constitutes acceptance of the revised Privacy Policy. We encourage you to check this page periodically. Prior versions are available on request by contacting [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or to how gbajr handles your personal data, please contact our support team directly. We take all privacy queries seriously and aim to respond fully within 48 hours during Bangladesh Standard Time business hours (09:00–22:00 BST, UTC+6).

Contact email: [email protected] (plain text only — not a clickable link). Please include the words Privacy Request in your message subject so our team can route your query to the correct handler promptly.