Privacy Policy — How gkbaje Protects Your Data

1. Information We Collect

gkbaje collects personal data through several channels: directly from you when you register or interact with the Platform, automatically through your device and browser as you use the Platform, and from third parties such as payment processors and identity verification providers where necessary to deliver our services.

1.1 Information You Provide Directly

When you register for a gkbaje account or interact with the Platform, you may provide the following categories of personal data:

• Identity data: Your full legal name, date of birth, and government-issued identity document number (National ID / passport), collected during registration and KYC verification.
• Contact data: Your Bangladeshi mobile phone number, which serves as your primary account identifier and is used for SMS OTP authentication and account communications.
• Financial data: Payment method identifiers (e.g., bKash account number, Nagad account number, bank account details) used to process deposits and withdrawals. gkbaje does not store full card numbers; card payment processing is handled by PCI-DSS-compliant third-party processors.
• Account credentials: Your chosen password (stored in hashed, salted form — never in plain text) and any two-factor authentication settings you configure.
• Communications data: The content of messages you send to gkbaje support via live chat or email, including your support ticket history, so that we can resolve your queries effectively.
• Responsible gaming preferences: Any deposit limits, session time limits, cool-off periods, or self-exclusion requests you submit through your account dashboard.

1.2 Information Collected Automatically

When you access the gkbaje Platform, certain technical and behavioural data is collected automatically through cookies, server logs, and similar technologies:

• Device and technical data: IP address, device type and model, operating system, browser type and version, screen resolution, and device language settings.
• Usage and activity data: Pages visited, time and duration of visits, games played, bets placed, transaction history, search queries on the Platform, and clickstream data showing how you navigate between sections.
• Location data: Country and city-level location inferred from your IP address, used for geo-restriction compliance and fraud detection. gkbaje does not collect precise GPS location data from your device.
• Session data: Login timestamps, session duration, and logout events, used to maintain account security and detect unusual access patterns.

1.3 Information from Third Parties

In limited circumstances, gkbaje may receive personal data about you from trusted third parties:

• Payment providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and card-processing networks may share transaction confirmation data, including partial account identifiers, to reconcile your deposits and withdrawals.
• Identity verification services: Where required, third-party KYC providers may cross-reference your submitted identity documents against official databases and share a verification result (pass/fail/refer) with gkbaje.
• Fraud prevention and risk intelligence: Industry-standard fraud-detection partners may flag device fingerprints, IP addresses, or account patterns associated with known fraudulent activity.

2. How We Use Your Data

gkbaje uses the personal data we collect for clearly defined purposes. We do not use your data for purposes incompatible with those stated at the time of collection without first obtaining your consent or establishing a new lawful basis.

2.1 Marketing Communications

gkbaje may send you promotional notifications about bonuses, seasonal offers (e.g., BPL Final promotions, Eid specials, Pohela Boishakh campaigns), and new game launches, but only where you have explicitly opted in to receive such communications at the time of registration or via your account notification preferences. You may withdraw consent for marketing communications at any time by updating your notification preferences in your account dashboard or by contacting our support team. Withdrawal of marketing consent does not affect the lawfulness of communications sent prior to withdrawal.

2.2 Automated Decision-Making

gkbaje uses automated systems to detect and flag potentially fraudulent activity, bonus abuse patterns, and problem gambling indicators. Where such systems generate a decision that materially affects your account (e.g., a temporary account restriction), you have the right to request human review of that decision by contacting our support team. We will always ensure that a qualified member of our compliance or player protection team reviews flagged cases before a permanent action is taken against your account.

3. Legal Basis for Processing

gkbaje processes your personal data only where we have a valid lawful basis for doing so. The four bases we rely on are as follows:

3.1 Contract Performance

The majority of data processing on gkbaje is necessary to perform the contract between you and gkbaje — that is, to provide you with the betting and gaming services you have registered to use. This includes creating your account, processing your transactions, settling your bets, and delivering customer support. Without this processing, gkbaje cannot fulfil its contractual obligations to you.

3.2 Legal Obligation

Certain processing is required by applicable law, including age verification, anti-money laundering (AML) checks, KYC document collection, and the retention of financial transaction records for mandatory audit periods. gkbaje cannot waive these obligations regardless of your preferences.

3.3 Legitimate Interests

Where processing is not required by contract or law but serves gkbaje's genuine operational interests — such as fraud prevention, network security, Platform analytics, and service improvement — we rely on legitimate interests as our lawful basis, provided those interests are not overridden by your fundamental rights. We conduct and document a balancing test before relying on this basis for any new processing activity.

3.4 Consent

For optional processing activities — primarily marketing communications and any non-essential analytics cookies — we rely on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without penalty. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4. Data Sharing & Third Parties

gkbaje does not sell or rent your personal data. We share your data only with the categories of third parties described below, and only to the extent strictly necessary for the stated purpose.

4.1 Payment Processors

To process your deposits and withdrawals, gkbaje shares necessary transaction data with your chosen payment provider. For mobile banking transactions via bKash, Nagad, Rocket, or Upay, this means sharing your registered mobile number and transaction amount with the relevant provider's API. For bank transfers through institutions such as Dutch-Bangla Bank, City Bank, or BRAC Bank, we share account reference data required to complete the transfer. All payment partners are contractually obligated to use your data solely for payment processing purposes.

4.2 Game and Technology Providers

To deliver casino games and live dealer experiences, gkbaje integrates with licensed game providers including Evolution Gaming, Pragmatic Play, Ezugi, Spribe, NetEnt, and Microgaming. These providers may receive a pseudonymous player session token and game-play data (bets placed, game rounds, outcomes) to run the game engine and calculate results. They do not receive your full name, mobile number, or financial details.

4.3 Identity Verification and KYC Providers

Where required to verify your identity or comply with AML obligations, gkbaje may share your submitted identity documents and related data with accredited KYC and identity verification service providers. These providers act as data processors under binding agreements that restrict them from using your data for any purpose other than verification.

4.4 Fraud Prevention and Security Partners

gkbaje uses third-party fraud detection and device fingerprinting services to protect the Platform from fraudulent accounts, bot activity, and money laundering. These partners process technical data (IP address, device identifiers, browser attributes) and return a risk signal. They do not have access to your financial transaction history or identity documents.

4.5 Legal and Regulatory Disclosure

gkbaje may disclose your personal data to law enforcement agencies, regulatory authorities, sports integrity organisations, or courts where required to do so by applicable law, or where we have a good-faith belief that disclosure is necessary to investigate suspected fraud, match-fixing, money laundering, or other serious criminal activity connected to your use of the Platform. We will notify you of any such disclosure to the extent permitted by law.

4.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a material part of gkbaje's assets, your personal data may be transferred to the successor entity as part of that transaction. We will provide notice of any such transfer and the successor entity will be required to honour this Privacy Policy or notify you of any material changes before your data is processed under new terms.

5. Cookies & Tracking Technologies

gkbaje uses cookies, web beacons, and similar tracking technologies on its Platform. This section explains what these technologies are, which categories gkbaje uses, and how you can manage your preferences.

5.1 What Are Cookies?

A cookie is a small text file placed on your device by a website you visit. Cookies allow the website to recognise your device on subsequent visits, maintain your session state, and remember your preferences. Cookies are not programs and cannot carry viruses or access your device's file system beyond the data they store.

5.2 Categories of Cookies Used by gkbaje

5.3 Managing Cookies

You can manage non-essential cookies through your gkbaje account preferences panel. You may also configure your browser to block or delete cookies; however, blocking strictly necessary or security cookies will prevent you from logging in and using the Platform. For guidance on managing cookies in your specific browser, refer to your browser's help documentation. Note that cookie preferences are stored per device and per browser — if you clear your browser data, you will need to re-set your preferences.

6. Data Retention

gkbaje retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention schedule applies:

At the end of the applicable retention period, gkbaje will securely delete or irreversibly anonymise your personal data. Where deletion is not immediately practicable due to backup or archiving processes, your data will be isolated from active systems and will not be subject to further processing until deletion is complete.

7. Your Rights & Choices

As a gkbaje player, you hold a meaningful set of rights over your personal data. These rights are exercisable at any time by contacting our support team. We will acknowledge your request within 5 business days and aim to resolve it within 30 days. Complex requests may take up to 60 days; in such cases, we will keep you informed of progress.

7.1 Right of Access

You have the right to request a copy of all personal data gkbaje holds about you. We will provide this in a structured, commonly used, machine-readable format. There is no fee for a first request within any 12-month period; subsequent requests within the same period may be subject to a reasonable administrative charge.

7.2 Right to Rectification

If any personal data gkbaje holds about you is inaccurate or incomplete, you have the right to request its correction. You may update many account details directly via your account settings; for data that cannot be self-corrected (such as KYC records), please contact our support team.

7.3 Right to Erasure ("Right to Be Forgotten")

You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and no other lawful basis applies, or where you object to processing based on legitimate interests and your interests override ours. This right is subject to our legal and regulatory retention obligations — for example, we cannot delete transaction records that we are required by law to retain for 5 years.

7.4 Right to Restriction of Processing

You may ask gkbaje to restrict the processing of your personal data while a dispute about its accuracy or our legal basis for processing is pending. During any restriction period, your data may be stored but will not be used for any active processing purpose beyond the minimum required to maintain your account record.

7.5 Right to Data Portability

Where processing is based on your consent or the performance of a contract and is carried out by automated means, you have the right to receive the personal data you have provided to gkbaje in a portable, structured format, and to transmit that data to another controller of your choosing.

7.6 Right to Object

You have the right to object to processing based on legitimate interests at any time. gkbaje will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims. You have an unconditional right to object to processing for direct marketing purposes; gkbaje will always honour this without requiring justification.

7.7 How to Exercise Your Rights

To exercise any of the rights above, contact our support team via live chat (available 24/7 on site) or email at [email protected]. Please include "Data Rights Request" in the subject line and provide your registered mobile number so we can verify your identity before processing the request. We may ask for additional verification to protect your data from unauthorised access requests.

8. Data Security

gkbaje implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Security is treated as a continuous programme, not a one-time implementation.

8.1 Technical Measures

• Transport encryption: All data in transit between your device and gkbaje servers is encrypted using TLS 1.2 or higher with HSTS enforcement.
• Data at rest: Sensitive data stored on gkbaje servers — including identity documents and financial account references — is encrypted at rest using AES-256.
• Password security: Account passwords are never stored in plain text. They are hashed using a strong, salted one-way algorithm (bcrypt).
• Two-factor authentication: SMS OTP-based 2FA is available to all players and strongly recommended. It adds a second layer of verification at each login, protecting your account even if your password is compromised.
• Intrusion detection: gkbaje's infrastructure is monitored 24/7 for anomalous access patterns, automated attacks, and data exfiltration attempts.
• Access controls: Access to production systems and player data is restricted to gkbaje staff who require it to perform their duties, governed by role-based access controls and multi-factor authentication for all administrative access.

8.2 Organisational Measures

• All gkbaje staff who handle personal data are trained on data protection obligations and our internal data handling procedures.
• Third-party data processors are vetted for security maturity and bound by data processing agreements before receiving access to any gkbaje player data.
• gkbaje conducts regular internal security reviews and acts on findings promptly.

8.3 Data Breach Response

In the event of a personal data breach that poses a risk to your rights and freedoms, gkbaje will notify affected players without undue delay via your registered contact details, providing details of the nature of the breach, the data involved, the likely consequences, and the steps gkbaje has taken or will take to address the breach and mitigate its impact.

8.4 Your Role in Account Security

While gkbaje takes its security responsibilities seriously, account security is a shared responsibility. You can protect your account by choosing a strong, unique password, enabling 2FA, not sharing your login credentials with anyone, and logging out of your account after each session — particularly on shared or public devices. Contact our support team immediately if you suspect your account has been accessed without your permission.