gbja Privacy Policy — How We Protect Your Personal Data

1 Introduction

gbja is committed to safeguarding the privacy and personal data of every player who uses our platform. This Policy applies to all personal data collected through the gbja website, mobile-optimised site, account registration process, payment processing flows, customer support interactions, promotional communications, and any other channel through which you interact with gbja.

This Policy should be read alongside the gbja Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of any inconsistency between those documents and this Policy on a privacy-related matter, this Policy shall take precedence.

gbja operates the Platform primarily for players located in Bangladesh. Our data practices are designed to align with internationally recognised privacy standards including purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability. We continuously review and update our practices to reflect evolving best practices in data protection.

2 Data We Collect

gbja collects personal data through several channels and in several categories. The following table summarises the categories of data we may collect about you:

Data You Provide Directly

The majority of personal data we hold about you is data you provide directly when you register an account, complete our Know Your Customer (KYC) verification process, make a deposit or withdrawal, contact our support team, or participate in a promotion. Providing accurate information at each of these stages is a condition of using the Platform.

Data Collected Automatically

When you visit or use the gbja Platform, certain technical and usage data is collected automatically through cookies, web beacons, server logs, and similar technologies. This data helps us operate the Platform securely, diagnose technical issues, analyse user behaviour in aggregate, and improve the player experience. See Section 8 (Cookies & Tracking) for full details.

Data from Third Parties

In limited circumstances, gbja may receive personal data about you from third parties, including payment processors (such as bKash and Nagad) who provide transaction confirmation data, identity verification service providers who assist with KYC checks, fraud prevention partners who flag suspicious activity, and analytics providers who help us understand aggregate traffic patterns. In all such cases, the third party is required to confirm that they have a lawful basis to share your data with us.

3 How We Use Your Data

gbja uses the personal data we collect for the following purposes:

• Account Creation and Management: To register your account, verify your identity and age (you must be 21 or older), maintain your account profile, and process account-related requests such as password resets and account closures.
• Payment Processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. All transactions are denominated in Bangladeshi Taka (৳/BDT).
• Service Delivery: To provide access to sports betting markets (including cricket, volleyball, and kabaddi), casino games, slots, and other features of the Platform.
• Customer Support: To respond to your enquiries, resolve disputes, and handle complaints. Support is provided in English, 24 hours a day, 7 days a week, including Bangladeshi public holidays.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, money laundering, account takeovers, and other prohibited activities. This includes automated risk-scoring and, where necessary, manual review by our compliance team.
• Responsible Gaming: To monitor play patterns for indicators of problem gambling, to facilitate the use of responsible gaming tools (deposit limits, self-exclusion, cooling-off periods), and to comply with our duty of care obligations to players.
• Legal and Regulatory Compliance: To meet any legal obligations to which gbja is subject, including record-keeping, reporting, and responding to lawful requests from competent authorities.
• Marketing and Promotions: To send you promotional offers, bonus notifications, and platform updates, but only where you have given your consent to receive such communications. You may withdraw consent at any time through your account settings or by contacting support.
• Platform Improvement: To analyse aggregate usage data for the purpose of improving the Platform's features, performance, user interface, and overall player experience.

gbja will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing an alternative lawful basis for processing.

4 Legal Basis for Processing

gbja processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing is necessary to perform our contract with you — that is, to operate your gbja account and provide the services you have registered for, including identity verification, payment processing, and service delivery.
• Legal Obligation: Processing is necessary for gbja to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) requirements, record-keeping obligations, and the obligation to prevent underage gambling.
• Legitimate Interests: Processing is necessary for gbja's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and improving the quality of our services, where those interests are not overridden by your privacy rights.
• Consent: For certain types of processing — in particular, the sending of marketing communications and the use of non-essential cookies — gbja relies on your freely given, specific, informed, and unambiguous consent. You have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5 Sharing Your Data

gbja does not sell your personal data to third parties. We may share your data with the following categories of recipient only where there is a legitimate purpose and, where required, a lawful basis for doing so:

Service Providers and Data Processors

gbja engages a limited number of carefully selected third-party service providers to assist in operating the Platform. These include payment processors (bKash, Nagad, Rocket, Upay, and banking partners), identity verification and KYC service providers, cloud hosting and infrastructure providers, fraud detection and cybersecurity partners, game software providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi), customer support software providers, and email and SMS communication platforms. All such providers are bound by data processing agreements that prohibit them from using your data for any purpose other than providing services to gbja.

Regulatory and Law Enforcement Authorities

gbja may disclose personal data to regulatory bodies, law enforcement agencies, courts, or other governmental authorities where required to do so by applicable law or where gbja reasonably believes that disclosure is necessary to prevent, detect, or prosecute fraud, money laundering, or other criminal activity. Where possible and legally permissible, gbja will notify you of such a disclosure.

Business Transfers

In the event that gbja or any part of its business is acquired, merged with, or transferred to another entity, your personal data may be transferred as part of that transaction. gbja will take reasonable steps to ensure that any acquirer is bound by privacy obligations consistent with this Policy. You will be notified of any such transfer via the email address registered to your account.

With Your Consent

gbja will share your personal data with any third party not listed above only where you have provided explicit consent to that specific sharing arrangement.

6 Data Security

gbja takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• SSL/TLS Encryption: All data transmitted between your device and the gbja Platform is encrypted using SSL/TLS protocols, ensuring that data in transit cannot be intercepted or read by unauthorised parties.
• Encryption at Rest: Sensitive personal data — including identity documents, financial records, and authentication credentials — is encrypted at rest within our secure database infrastructure.
• Access Controls: Access to personal data within gbja's systems is restricted on a strict need-to-know basis. All staff with access to personal data are trained in data protection best practices and are bound by confidentiality obligations.
• Two-Factor Authentication (2FA): gbja offers 2FA for player accounts and requires it for all internal administrative access to systems that process personal data.
• Regular Security Audits: gbja's infrastructure is subject to regular security assessments, penetration testing, and vulnerability scanning to identify and address potential weaknesses.
• Incident Response: gbja maintains a documented data breach response plan. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, gbja will notify affected players as quickly as practicable, providing details of the nature of the breach, the likely consequences, and the measures taken or proposed to address it.

While gbja takes all reasonable steps to protect your data, no method of transmission over the internet or method of electronic storage is completely secure. You are responsible for keeping your account credentials — including your password and any 2FA codes — confidential. If you suspect that your account has been compromised, please contact gbja support immediately at [email protected].

7 Data Retention

gbja retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, as described in this Policy, or as required by applicable law. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active account relationship with gbja, plus a minimum of 5 years following account closure. This retention is required to meet anti-money laundering record-keeping obligations.
• Financial and Transaction Data: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial record-keeping requirements.
• Customer Support and Communications Data: Retained for 3 years from the date of the interaction, or for the duration of any unresolved dispute, whichever is longer.
• Marketing Preferences and Consent Records: Retained for the duration of your account, plus 2 years following account closure, to demonstrate the basis on which marketing communications were sent.
• Technical and Usage Data: Aggregated or anonymised after 24 months unless retained in identifiable form for an ongoing fraud investigation or legal proceeding.

Where gbja retains data beyond the initial purpose period for legal compliance reasons, that data will be restricted from active use and held solely for the purposes of meeting the relevant legal obligation. Upon expiry of all applicable retention periods, personal data is securely deleted or irreversibly anonymised.

8 Cookies & Tracking

gbja uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device when you visit a website. Cookies help the Platform function correctly, remember your preferences, keep your session secure, and analyse how players interact with the site.

Categories of Cookies We Use

• Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be switched off. They include session management cookies that keep you logged in, security tokens, and cookies that support payment processing flows. These cookies do not require your consent.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, notification settings, and responsible gaming tool configurations — to provide a more personalised experience. These cookies require your consent.
• Analytics Cookies: These cookies collect aggregated, anonymised information about how players use the Platform, which pages are visited most frequently, and where players encounter errors. This data helps gbja improve the Platform. Analytics cookies require your consent.
• Marketing Cookies: These cookies track your visits to the Platform and are used to deliver promotional content that is relevant to your interests. Marketing cookies require your explicit consent and will only be set if you have opted in to marketing communications.

Managing Cookies

You can manage your cookie preferences at any time through your account settings on the gbja Platform. You may also configure your browser to block or delete cookies; however, please note that blocking strictly necessary cookies will impair the functionality of the Platform, and you may not be able to log in or use certain features. Deleting analytics or marketing cookies will not affect your ability to use the core Platform features.

9 Your Rights

As a player on the gbja Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact the gbja support team at [email protected]. We aim to respond to all data rights requests within 30 calendar days. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

• Right of Access: You have the right to request a copy of all personal data that gbja holds about you, together with information about how it is used, who it has been shared with, and how long it will be retained.
• Right to Rectification: You have the right to request that gbja corrects any inaccurate or incomplete personal data we hold about you. You can update many of your account details directly through your account settings panel.
• Right to Erasure: You have the right to request that gbja deletes your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other lawful basis applies), or where we have processed it unlawfully. This right is subject to legal retention obligations — for example, gbja is required to retain transaction records for AML compliance purposes and cannot delete them on request during the mandatory retention period.
• Right to Restriction: You have the right to request that gbja restricts processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved.
• Right to Data Portability: You have the right to receive personal data that you have provided to gbja in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Object: You have the right to object to gbja processing your personal data where that processing is based on legitimate interests. You also have the absolute right to object to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where gbja processes your data based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

gbja will not charge a fee for processing data rights requests unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply. Where gbja cannot fulfil a request — for example, because doing so would conflict with a legal obligation — we will explain the reason clearly and advise on any alternative steps available to you.

10 Minors & Age Policy

The gbja Platform is strictly for use by individuals aged 21 years and older. gbja does not knowingly collect, process, or retain personal data from any person under the age of 21. All accounts are subject to age verification as part of the KYC process, and gbja uses automated and manual controls to prevent underage access.

If gbja becomes aware that personal data has been collected from a person under the age of 21 — whether through erroneous registration, misrepresentation of age, or any other means — that data will be immediately deleted, the account will be closed, and any deposits will be returned to the original payment method. Winnings generated on an underage account will be forfeited.

If you believe that a minor has registered an account on the gbja Platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

11 International Transfers

gbja operates primarily to serve players in Bangladesh. In certain cases, personal data may be processed by service providers or infrastructure partners located outside Bangladesh — for example, cloud hosting providers or third-party game suppliers whose servers are based in other jurisdictions.

Where personal data is transferred internationally, gbja takes steps to ensure that an adequate level of protection is maintained. This includes entering into data processing agreements with all international service providers that incorporate standard contractual clauses or equivalent protections, and conducting due diligence on the data protection standards of third-party recipients before any transfer takes place.

By using the gbja Platform, you acknowledge and consent to the transfer of your personal data to countries that may not have data protection laws equivalent to those in Bangladesh, subject to the safeguards described above.

12 Third-Party Links

The gbja Platform may contain links to third-party websites or services — for example, to the websites of game providers such as Pragmatic Play or Evolution Gaming, or to payment provider information pages. This Privacy Policy applies only to the gbja Platform and does not extend to any third-party sites or services. gbja is not responsible for the privacy practices, content, or data handling of any third-party website, and we encourage you to read the privacy policy of any site you visit via a link from the gbja Platform.

13 Changes to This Policy

gbja reserves the right to update or amend this Privacy Policy at any time. When we make material changes — that is, changes that significantly affect how your personal data is used or your privacy rights — we will notify you by email at the address registered to your gbja account, or by displaying a prominent notice on the Platform, at least 14 days before the changes take effect.

Non-material amendments, such as corrections to typographical errors, clarifications that do not alter the substance of the Policy, or updates to contact information, may be published without prior notice and take effect immediately upon publication. The effective date shown at the top of this Policy and in the table of contents reflects the date of the most recent update.

Your continued use of the gbja Platform after an updated Privacy Policy takes effect constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to stay informed about how gbja protects your data.

14 Contact & DPO

If you have any questions, concerns, or requests in relation to this Privacy Policy or the way gbja handles your personal data, please contact the gbja Data Protection team using the details below. All privacy-related correspondence is handled in English, 24 hours a day, 7 days a week.

• Email: [email protected] — please include "Privacy Request" in the subject line of your email so that your message is directed to the appropriate team. This is plain text only; it is not a clickable link.
• Response Time: gbja aims to acknowledge all privacy-related enquiries within 24 hours and provide a substantive response within 30 calendar days.
• Support Hours: 24 hours a day, 7 days a week, including Bangladeshi public holidays (Eid, Pohela Boishakh, Victory Day, Independence Day, Durga Puja). All response times are measured in Bangladesh Standard Time (BST, UTC+6).

When submitting a data rights request, please provide your registered username, the email address associated with your account, and a clear description of the right you wish to exercise or the concern you wish to raise. This will allow gbja to locate your account records and process your request as efficiently as possible.

gbja takes all privacy complaints seriously. If you submit a formal complaint and are not satisfied with our response, you have the right to seek further redress through applicable legal channels.