Your Privacy at gbaj – How We Protect Your Data

This Privacy Policy ("Policy") describes how gbaj ("we", "us", "our") collects, uses, stores, shares, and protects personal information provided by users ("you", "your") of the gbaj platform available at gbaj.asia. It applies to all interactions with the gbaj platform, including account registration, deposits and withdrawals, game participation, customer support communications, and promotional activities.

This Policy should be read alongside the gbaj Terms & Conditions and the Responsible Gaming Policy, both of which are incorporated by reference into the overall agreement between you and gbaj.

By registering an account on the gbaj platform and using our Services, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the gbaj platform and contact our support team to arrange account closure.

For the purposes of this Policy, gbaj acts as the data controller in respect of all personal data collected through the gbaj platform. As data controller, gbaj determines the purposes and means by which your personal data is processed.

All data-related enquiries, access requests, and complaints may be directed to the gbaj data protection contact via the support address provided in Section 16 of this Policy. gbaj is committed to responding to all data-related correspondence within a reasonable timeframe in accordance with applicable data protection obligations.

gbaj collects personal data that is necessary to provide you with a safe, compliant, and functional online gaming experience. The categories of personal data we collect include:

gbaj collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing your profile, submitting KYC documents, contacting support, or filling in any form on the gbaj platform.
• Automated technical collection: Data collected automatically when you access the gbaj platform, including IP address, device identifiers, browser fingerprint, session metadata, and cookies (see Section 8).
• Transactional data: Data generated when you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, or Mastercard. This data is collected from our payment processing partners and is governed by both this Policy and the privacy policies of those payment providers.
• Game provider data: Aggregated game outcome and wagering data passed to gbaj by licensed game providers such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe for the purpose of dispute resolution, responsible gaming monitoring, and RTP reporting.
• Publicly available sources: In some circumstances, gbaj may verify identity or fraud indicators using publicly available databases or third-party identity verification services.

gbaj processes your personal data on the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing that is required to fulfil the agreement between you and gbaj — including account registration, payment processing, game participation, and customer support — is carried out on the basis that it is necessary to perform the contract you have entered into with us.
• Legal obligation: Certain processing activities, including KYC verification, anti-money laundering (AML) checks, and the retention of transaction records, are carried out to comply with applicable legal and regulatory obligations.
• Legitimate interests: gbaj processes certain technical and usage data on the basis of its legitimate interests in maintaining platform security, preventing fraud, improving service quality, and monitoring for responsible gaming indicators — provided those interests are not overridden by your fundamental privacy rights.
• Consent: Where gbaj wishes to send you marketing communications or use your data for purposes that go beyond what is strictly necessary, we will obtain your explicit consent before doing so. You may withdraw consent at any time by contacting [email protected].

gbaj uses the personal data it collects for the following purposes:

• Creating and managing your gbaj account, including verifying your identity and confirming your eligibility to use the platform (21+ requirement).
• Processing your deposits and withdrawals via supported payment methods including bKash, Nagad, and Rocket, and maintaining accurate financial records of all transactions.
• Delivering the gaming and sports betting services you request, including settling bets, crediting winnings, applying bonuses, and resolving game disputes.
• Communicating with you regarding your account status, security alerts, transaction confirmations, bonus eligibility, and responses to your support enquiries.
• Monitoring your gameplay for responsible gaming indicators, including unusual betting patterns, extended session times, or rapid escalation of deposit amounts, in order to offer appropriate intervention tools such as deposit limits or self-exclusion.
• Detecting, investigating, and preventing fraud, money laundering, collusion, bonus abuse, and other prohibited conduct as defined in the gbaj Terms & Conditions.
• Improving the gbaj platform, personalising your experience, and conducting internal analytics to understand how Users engage with our Services.
• Sending you promotional communications about bonuses and offers (only where you have provided consent or where permitted under applicable law, and always with the option to opt out).
• Complying with legal, regulatory, and tax obligations applicable to the operation of the gbaj platform.

gbaj may share your personal data with the following categories of recipients in the circumstances described:

• Payment processing partners: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive the minimum data necessary to process your deposit or withdrawal transaction. These partners operate under their own privacy policies and data security obligations.
• Game technology providers: Licensed game studios including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe receive pseudonymised gameplay data for the purposes of game operation, RTP reporting, and dispute resolution.
• Identity verification services: Third-party KYC and AML service providers may receive your identity documents and personal data for the purpose of completing verification checks required under our compliance obligations.
• Legal and regulatory authorities: gbaj will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, valid legal process, or in order to protect the legal rights and security of gbaj, its staff, or its Users.
• Professional advisers: Lawyers, auditors, and other professional advisers engaged by gbaj may access personal data on a confidential basis in the performance of their professional services.
• Business successors: In the event of a merger, acquisition, or sale of the gbaj business or any part of it, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections remaining in place.

In all cases where gbaj shares personal data with third parties, we take reasonable steps to ensure those parties handle the data in a manner consistent with this Policy and applicable data protection standards.

gbaj uses cookies and similar tracking technologies (including local storage objects and session tokens) to operate the platform, maintain your logged-in session, personalise your experience, and collect analytics data. The categories of cookies used on the gbaj platform are as follows:

• Essential cookies: These cookies are strictly necessary to operate the gbaj platform. They enable core functions such as session management, login authentication, and security token validation. The platform cannot function without these cookies and they cannot be disabled.
• Performance and analytics cookies: These cookies collect aggregated, anonymised data about how Users interact with the gbaj platform — such as which pages are visited most frequently and how long Users spend on particular sections. This data is used to improve the platform's functionality and content.
• Functional cookies: These cookies remember your preferences — such as your preferred game categories or notification settings — in order to provide a more personalised experience on return visits.
• Security cookies: These cookies are used to detect and prevent fraudulent activity, including bot traffic, credential stuffing attempts, and session hijacking.

gbaj retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. Our general retention guidelines are as follows:

• Active account data: Personal data associated with an active gbaj account is retained for the full duration of the account's existence and for a minimum period of five (5) years following account closure, in accordance with financial record-keeping obligations.
• KYC and identity documents: Copies of identity documents submitted for KYC verification are retained for a minimum of five (5) years following account closure, as required for AML compliance purposes.
• Transaction records: All deposit and withdrawal records are retained for a minimum of five (5) years from the date of the transaction, in compliance with applicable financial regulations.
• Support communications: Customer support correspondence is retained for a minimum of three (3) years following the resolution of the relevant interaction, for the purpose of quality assurance and dispute resolution.
• Technical and usage data: Anonymised or aggregated analytics data may be retained indefinitely for internal reporting and platform improvement purposes. Identifiable technical data (such as IP logs) is retained for a maximum of twelve (12) months unless retention beyond that period is required for an ongoing investigation.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

gbaj implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• SSL/TLS encryption on all data transmitted between your device and the gbaj platform.
• Encrypted storage of sensitive personal data, including financial account details and identity documents.
• OTP (one-time password) verification for all withdrawal requests, providing a second layer of authentication beyond your account password.
• Role-based access controls that restrict access to personal data to gbaj staff members who require it to perform their legitimate job functions.
• Regular security audits and penetration testing of the gbaj platform infrastructure.
• Logging and monitoring of all access to systems that store personal data, enabling prompt detection of unauthorised access attempts.

In the event of a data breach that poses a material risk to your rights or interests, gbaj will notify affected Users within a reasonable timeframe using the contact details registered on your account.

Subject to applicable law and certain conditions, you have the following rights in relation to the personal data that gbaj holds about you:

• Right of access: You have the right to request a copy of the personal data that gbaj holds about you, together with information about how it is being processed.
• Right to rectification: You have the right to request that gbaj correct any inaccurate or incomplete personal data held about you without undue delay.
• Right to erasure: You have the right to request that gbaj delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been processed unlawfully. This right is subject to gbaj's legal obligation to retain certain data for the minimum retention periods described in Section 9.
• Right to restriction of processing: You have the right to request that gbaj restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data while gbaj verifies it.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing carried out on the basis of gbaj's legitimate interests, including profiling. You also have an unconditional right to object to processing of your data for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact the gbaj support team at [email protected] (plain text — not a clickable link). gbaj will respond to all valid rights requests within a reasonable period. In some cases, gbaj may need to verify your identity before acting on a request.

The gbaj platform is strictly intended for adults aged 21 years and above. gbaj does not knowingly collect personal data from any individual under the age of 21. If gbaj becomes aware that it has inadvertently collected personal data from a person under 21, that data will be deleted immediately and the associated account will be permanently closed.

If you believe that a minor has accessed the gbaj platform or submitted personal data to us, please notify us immediately at [email protected] so that we can take prompt corrective action. gbaj takes its obligations with respect to the protection of minors very seriously and maintains active age verification processes to enforce the 21+ requirement.

The gbaj platform may contain references to third-party services such as payment providers (bKash, Nagad, Rocket), game studios (Pragmatic Play, Evolution Gaming), and other service partners. Where such references include links to external websites or services, gbaj is not responsible for the privacy practices or content of those third-party sites.

This Privacy Policy applies exclusively to the gbaj platform at gbaj.asia. If you follow a link to any third-party website or service, you should read that party's own privacy policy before providing any personal data. gbaj cannot guarantee the data protection standards of any third-party service, even where that service is integrated with or accessible via the gbaj platform.

In the course of operating the gbaj platform, personal data may be transferred to, stored in, or processed by systems located outside Bangladesh — for example, where game technology providers or cloud infrastructure services are hosted in other jurisdictions. Where such transfers occur, gbaj takes reasonable steps to ensure that the receiving party applies data protection standards that are materially equivalent to those described in this Policy.

In all cases, international data transfers by gbaj are limited to what is strictly necessary for the operation of the platform and the fulfilment of your service agreement with gbaj. gbaj does not make international transfers of personal data for commercial purposes unrelated to the provision of its Services.

gbaj reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the structure of the gbaj platform. Where amendments are material, gbaj will make reasonable efforts to notify registered Users via their registered email address or through a prominent notice on the platform prior to the changes taking effect.

The effective date displayed at the top of this Policy and the "Last updated" indicator in the table of contents reflect the most recent revision. Your continued use of the gbaj platform after the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you should discontinue use of the platform and request account closure.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way gbaj processes your personal data, please contact us through the following channel:

• Email: [email protected] (plain text — not a clickable link)
• Subject line: Please include "Privacy Request" or "Data Protection Enquiry" in your subject line so that your message is routed to the appropriate team.
• Response time: gbaj aims to acknowledge all privacy-related correspondence within 48 hours Bangladesh Standard Time (BST, UTC+6) and to provide a substantive response within 30 days of receipt.
• Support hours: 24 hours a day, 7 days a week.

For responsible gaming concerns specifically, please visit the Responsible Gaming page for dedicated guidance, self-exclusion tools, and external support resources available to players in Bangladesh.