gbaji Privacy Policy —
Your Data, Your Rights, Our Promise

gbaji is an online betting and casino platform operated under international offshore licensing and made available to players in Bangladesh and other permitted territories. We are committed to handling personal data with transparency, integrity, and care.

This Privacy Policy applies to all personal data collected through the gbaji website at gbaji.vu, any gbaji mobile applications, our customer support channels (live chat, email, and WhatsApp), and any other services or touchpoints through which gbaji interacts with registered or prospective players.

The terms "personal data" and "personal information" in this policy refer to any information that can be used, directly or indirectly, to identify a natural person — including your name, date of birth, email address, mobile number, payment account details, device identifiers, and betting activity records.

By creating an account on gbaji, you confirm that you are at least 21 years of age, that the personal information you provide is accurate, and that you consent to the collection and use of your data as described in this Privacy Policy. If you do not agree with any part of this policy, you should not register an account or continue to use gbaji's services.

gbaji collects personal data from you in three ways: directly when you provide it to us, automatically when you use our platform, and occasionally from trusted third-party sources for verification purposes. The categories of data we collect are as follows:

2.1 Data You Provide Directly

2.2 Data Collected Automatically

• Usage Data: Pages visited, games played, bets placed, session duration, features accessed, and search queries made within the gbaji platform.
• Technical Data: IP address, browser type and version, operating system, device type (mobile/desktop), screen resolution, time zone (Bangladesh Standard Time, UTC+6), and referring URL.
• Transaction Data: Full history of deposits, withdrawals, bonuses credited, bonus wagering activity, and bet settlement records.
• Responsible Gaming Data: Deposit limit settings, session reminder preferences, cool-down periods, and self-exclusion status.
• Cookie & Tracking Data: See Section 6 for full details on cookies and similar tracking technologies used by gbaji.

2.3 Data From Third Parties

In limited circumstances, gbaji may receive personal data about you from trusted third-party sources, including:

• Identity verification service providers, who may confirm that the name and date of birth you provided match records in their database.
• Payment processors such as bKash, Nagad, Rocket, and Upay, who confirm the status and ownership of the payment account you have registered with gbaji.
• Fraud prevention and anti-money-laundering databases that may flag accounts associated with known financial crime activity.

gbaji uses your personal data for clearly defined purposes. We do not use your data in ways that are incompatible with the purposes stated below without first obtaining your explicit consent.

• Account Administration: Creating and managing your gbaji account, verifying your identity at registration and at withdrawal, and maintaining accurate records of your account activity.
• Payment Processing: Executing deposit and withdrawal transactions via bKash, Nagad, Rocket, Upay, bank transfer, Visa, and Mastercard. Verifying that payment methods are registered in your own name to comply with anti-money-laundering obligations.
• Regulatory Compliance: Meeting our Know Your Customer (KYC), Anti-Money Laundering (AML), and counter-terrorism financing (CTF) obligations under the terms of gbaji's offshore operating licence.
• Fraud Prevention & Security: Detecting and investigating suspicious account activity, duplicate account registrations, bonus abuse, automated betting, and other forms of prohibited conduct as defined in the gbaji Terms & Conditions.
• Responsible Gaming: Monitoring betting and session patterns to identify indicators of problem gambling, and facilitating the use of responsible gaming tools including deposit limits, cool-down periods, and self-exclusion.
• Customer Support: Responding to your support enquiries, resolving disputes, and maintaining records of support interactions for quality assurance purposes.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the performance, navigation, game selection, and overall user experience of the gbaji platform for players across Bangladesh.
• Marketing Communications: Sending you information about gbaji bonuses, promotions, and new features — but only where you have explicitly opted in to receive marketing communications. See Section 13 for your marketing preferences and opt-out options.
• Legal Proceedings: Establishing, exercising, or defending legal claims arising from your use of the gbaji platform.

gbaji processes your personal data on the following legal bases:

• Contractual Necessity: Processing your identity data, contact data, and payment data is necessary for gbaji to fulfil its contractual obligations to you as a registered account holder — including processing deposits and withdrawals, settling bets, and administering your account.
• Legal Obligation: Processing your identity documents and transaction history is required to meet gbaji's KYC, AML, and CTF obligations under the terms of its offshore operating licence.
• Legitimate Interests: gbaji processes usage data, technical data, and fraud-related data on the basis of its legitimate interest in operating a secure, fair, and commercially viable platform. This processing is balanced against your right to privacy and does not override your fundamental interests.
• Consent: Processing your data for marketing communications is based on your explicit opt-in consent. You may withdraw this consent at any time. Withdrawal of consent for marketing does not affect the lawfulness of processing carried out on other legal bases.

gbaji does not sell, rent, or share your personal data with third parties for their own commercial purposes. We share your data only in the following specific and limited circumstances:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard receive the minimum data necessary to execute your deposit and withdrawal transactions.
• Game Technology Providers: Pragmatic Play, Evolution Gaming, Ezugi, Microgaming, NetEnt, and Spribe may process limited session data (such as your player ID, game session token, and wager amounts) as part of delivering their games on the gbaji platform. These providers act as data processors under contractual data processing agreements with gbaji.
• Identity Verification Providers: Third-party KYC service providers may receive your name, date of birth, and document details for the purpose of verifying your identity. These providers are bound by strict data processing agreements and may not use your data for any other purpose.
• Fraud Prevention Services: gbaji may share account identifiers and behavioural indicators with fraud prevention databases and AML screening services to detect and prevent financial crime.
• Legal & Regulatory Authorities: gbaji may disclose your personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, a valid court order, or the terms of gbaji's operating licence. gbaji will notify you of any such disclosure where legally permitted to do so.
• Business Transfers: In the event that gbaji or its operating entity is subject to a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer via email prior to your data being transferred to or becoming subject to a different privacy policy.

gbaji uses cookies and similar tracking technologies (such as web beacons and local storage objects) to operate and improve the platform. A cookie is a small text file stored on your device when you visit a website. The cookies used by gbaji fall into the following categories:

You can control cookie preferences through your browser settings. Most modern browsers allow you to view, block, or delete cookies. Please note that disabling strictly necessary cookies will impair your ability to log in and use core gbaji account features. Disabling functional or analytics cookies will not prevent you from using the platform but may affect your personalisation experience.

gbaji implements a multi-layered approach to data security designed to protect your personal information against unauthorised access, accidental loss, alteration, or disclosure. Our security measures include:

• Encryption in Transit: All data exchanged between your browser or app and gbaji's servers is encrypted using TLS 1.2 or higher. The gbaji platform enforces HTTPS across all pages and API endpoints.
• Encryption at Rest: Sensitive personal data, identity documents, and payment account information stored on gbaji's infrastructure are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within gbaji's internal systems is restricted on a strict need-to-know basis. Staff members are granted access to personal data only to the extent required to perform their specific role. All internal data access events are logged and audited.
• Two-Factor Authentication: gbaji's internal administrative systems require two-factor authentication (2FA) for all staff accounts. We strongly recommend that players also use strong, unique passwords for their gbaji accounts.
• Penetration Testing: gbaji conducts regular security assessments including penetration testing to identify and remediate vulnerabilities in the platform.
• Incident Response: gbaji maintains a documented data breach response procedure. In the event of a confirmed data breach that poses a material risk to affected players, gbaji will notify impacted users within 72 hours of becoming aware of the breach, where technically and legally feasible.

gbaji retains personal data only for as long as it is necessary for the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is either permanently deleted from gbaji's systems or irreversibly anonymised so that it can no longer be linked to you as an individual. Where deletion is delayed due to a pending legal dispute or regulatory investigation, gbaji will retain the data for the duration of that matter and delete it promptly upon resolution.

As a registered user of gbaji, you hold the following rights in respect of your personal data. These rights can be exercised at any time by contacting gbaji's support team via live chat or email at [email protected].

gbaji will respond to all data rights requests within 30 days of receipt. Where a request is complex or we receive a high volume of requests simultaneously, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it. gbaji does not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive.

gbaji's services are strictly limited to individuals who are 21 years of age or older. gbaji does not knowingly collect, process, or retain personal data relating to individuals under the age of 21. Age verification is a mandatory step in the gbaji account registration and KYC process, and accounts found to belong to individuals under 21 will be immediately suspended and any remaining balance returned.

If you are a parent or guardian and you believe that a minor under your care has registered an account with gbaji or has provided personal information to gbaji without your consent, please contact our support team immediately at [email protected]. Upon verification of the report, gbaji will promptly close the account and delete all associated personal data.

gbaji operates under an international offshore licence and its servers and data processing infrastructure may be located outside Bangladesh. As a result, your personal data may be transferred to and processed in countries other than Bangladesh. These countries may have data protection laws that differ from those in your home jurisdiction.

When gbaji transfers personal data internationally, we ensure that appropriate safeguards are in place to protect your data to a standard at least equivalent to that described in this Privacy Policy. Safeguards used by gbaji for international transfers include:

• Contractual data processing agreements with all third-party service providers that impose data protection obligations equivalent to those gbaji applies internally.
• Technical security controls including encryption in transit and at rest, as described in Section 7 of this Privacy Policy.
• Limiting the data shared internationally to the minimum necessary for the specific processing purpose.

By registering an account with gbaji and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data to international locations for the purposes described in this policy.

The gbaji platform may reference or integrate with third-party services including game providers (Pragmatic Play, Evolution Gaming, Ezugi, Microgaming, NetEnt, Spribe) and payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard). When you interact with a third-party game or payment interface, that provider's own privacy policy governs the collection and use of any data processed directly by that provider.

gbaji is not responsible for the privacy practices of third-party service providers. We recommend that you review the privacy policies of any third-party providers whose services you use in connection with your gbaji account. gbaji selects third-party providers carefully and requires all providers to maintain appropriate data security standards as a condition of their contract with gbaji, but ultimate responsibility for their own privacy practices rests with those providers.

gbaji does not include links to unrelated external websites on the gbaji platform. If you navigate away from gbaji.vu to any external site, this Privacy Policy no longer applies to any data collected by that external site.

gbaji will only send you promotional emails, SMS messages, or WhatsApp notifications about bonuses, new games, seasonal promotions (such as Eid specials, Pohela Boishakh offers, or BPL cricket promotions), and other gbaji marketing content if you have explicitly opted in to receive such communications during registration or through your account settings.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the unsubscribe link included in any gbaji marketing email.
• Updating your communication preferences in your gbaji account settings.
• Contacting gbaji support via live chat or at [email protected] and requesting removal from all marketing lists.

Withdrawal of marketing consent will be processed within 5 business days. Please note that opting out of marketing communications does not affect transactional communications — gbaji will continue to send you account-related notifications such as deposit confirmations, withdrawal updates, KYC requests, and security alerts regardless of your marketing preference.

gbaji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our platform. The "Last Reviewed" date displayed at the top of this page will be updated whenever any change is made.

Where an update is material — meaning it significantly affects the way we collect, use, or share your personal data, or meaningfully changes your rights — gbaji will notify you by email to your registered email address at least 7 days before the updated policy takes effect. For non-material changes such as typographical corrections or minor clarifications, gbaji may update the policy without advance notice.

Your continued use of the gbaji platform following the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree with any update to this policy, you should cease using the gbaji platform and may request account closure by contacting our support team. Any outstanding balance will be returned to you following completion of standard identity verification.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights described in Section 9, or want to report a concern about how gbaji has handled your personal data, please contact the gbaji data support team through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly from the gbaji platform. Average response time under 2 minutes. This is the fastest channel for urgent data concerns.
• Email: [email protected] (plain text — not a clickable link). Please include "Privacy Request" in your subject line and provide your registered username and the nature of your request. We aim to respond within 2 business days for privacy-related enquiries.
• WhatsApp: +880 1700 000000. Available during Bangladesh Standard Time business hours (08:00–22:00 BST, UTC+6). Response time under 30 minutes during operating hours.

For formal data subject access requests or erasure requests, please contact us via email with the subject line "Data Subject Request — [Your Username]" and include a copy of a government-issued identity document to verify your identity before we process the request. This verification step is required to protect your data from being disclosed or deleted in response to fraudulent requests submitted by third parties.