gbajo Privacy Policy — How We Protect Your Data

gbajo operates the online betting and live casino platform accessible at gbajo.io. As part of providing our services to players across Bangladesh — including those in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar — we necessarily collect and process personal information about the individuals who register accounts, make transactions, and interact with our platform.

This Privacy Policy is designed to give you a clear, honest account of our data practices. It covers what personal data we collect, the circumstances in which we collect it, the purposes for which we use it, with whom we may share it, how long we retain it, and the rights you can exercise in relation to it.

This policy should be read alongside the gbajo Terms and Conditions, which together form the full agreement governing your use of our platform. Where this Privacy Policy is incorporated by reference into the Terms and Conditions, both documents are binding on you as a registered player.

We review and update this policy periodically to reflect changes in our data practices, applicable law, or the services we offer. The effective date at the top of this page indicates when the current version was last revised. Continued use of the gbajo platform following the publication of a revised policy constitutes your acknowledgement of the changes.

gbajo collects personal data across several categories, depending on the nature of your interaction with our platform. The following table summarises the main data types we hold:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or biometric data for identification purposes, except where documentary identity verification (such as a scanned National ID card) incidentally contains such information.

gbajo collects personal data through several channels, which can be grouped into three broad categories:

Data you provide directly. This is information you enter into our platform yourself — for example, during account registration, when completing your KYC submission, when making a deposit or withdrawal, when updating your account profile, or when contacting our customer support team via Live Chat or email at [email protected].

Data collected automatically. When you visit gbajo.io, our servers and analytics tools automatically collect certain technical data about your device and browsing session. This includes your IP address, device identifiers, browser details, the URL you navigated from, pages you visited on our site, how long you spent on each page, and the actions you performed. This collection happens whether or not you are logged in to an account.

Data received from third parties. In some cases, we receive personal data from third-party service providers who work with us to deliver parts of our service. For example:

• Payment processors (such as bKash, Nagad, Rocket, and Upay) may provide transaction confirmation data including wallet identifiers and payment statuses.
• KYC and identity verification service providers may return results of document checks and identity matching scores.
• Fraud detection and AML screening providers may share risk assessment data tied to a player's profile or transaction patterns.
• Game Providers (such as Pragmatic Play, Evolution Gaming, Spribe, Habanero, Microgaming, and Ezugi) may share session-level game logs and RNG outcome data relevant to a specific player account.

gbajo uses the personal data we collect for a defined set of purposes. We do not use your data in ways that are incompatible with the purpose for which it was originally collected without first obtaining your consent or having another lawful basis to do so. Our primary purposes are:

• Account creation and management. To register your account, authenticate your identity when you log in, manage your account settings and preferences, and communicate with you about your account status.
• Service delivery. To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank; to make sports betting markets and casino games available to you; and to settle bets, credit winnings, and apply bonuses correctly to your account balance.
• Legal and regulatory compliance. To verify your age (21+ requirement), complete KYC checks, fulfil our anti-money laundering obligations, respond to lawful requests from competent authorities, and maintain transaction records for the periods required by law.
• Fraud prevention and security. To detect and prevent unauthorised account access, detect suspicious wagering patterns, identify and investigate potential bonus abuse, and protect the integrity of our platform and other players.
• Customer support. To respond to your enquiries, resolve complaints, process responsible gaming tool requests (such as deposit limits, cooling-off periods, and self-exclusion), and improve the quality of our support service.
• Platform improvement. To analyse aggregated behavioural and technical data in order to identify bugs, improve page performance, enhance the user experience, and make informed decisions about new features and products.
• Responsible gaming. To monitor wagering behaviour for indicators of problem gambling, to enforce the limits and restrictions you have set on your account, and to reach out proactively where our systems identify patterns that suggest a player may benefit from responsible gaming support.
• Marketing communications. To send you promotional offers, bonus announcements, event notifications (such as BPL, IPL, T20 World Cup markets, Eid promotions, and Pohela Boishakh specials), and personalised recommendations — but only where you have given your consent to receive such communications or where we have another valid basis to contact you.

For each purpose described in Section 4, gbajo relies on one or more of the following legal bases for processing your personal data:

• Contractual necessity. Processing is necessary for the performance of the contract between you and gbajo — i.e., the Terms and Conditions you accept when registering an account. This covers account creation, payment processing, bet settlement, and customer support.
• Legal obligation. Processing is required to comply with a legal requirement to which gbajo is subject. This covers KYC/AML obligations, age verification, and the retention of financial transaction records.
• Legitimate interests. Processing is necessary for gbajo's legitimate business interests, provided those interests are not overridden by your rights and freedoms. This covers fraud detection, platform security, responsible gaming monitoring, and product analytics.
• Consent. Where no other basis applies, gbajo relies on your freely given, specific, and informed consent. This is the primary basis for sending you marketing communications and for placing non-essential cookies on your device. You may withdraw your consent at any time without affecting the lawfulness of processing that took place before the withdrawal.

gbajo does not sell your personal data to third parties. We share your data only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment processors. We share the minimum financial data necessary to process your deposit or withdrawal with the relevant payment provider (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank). These providers operate under their own privacy policies and are bound by contractual data protection obligations when processing data on our behalf.
• KYC and identity verification providers. We share identity document scans and personal details with our third-party verification partners to carry out age and identity checks. These providers are contractually prohibited from using your data for any purpose other than providing verification services to gbajo.
• Game Providers. Game studios (including Pragmatic Play, Evolution Gaming, Spribe, Habanero, Microgaming, Ezugi, and NetEnt) may receive a pseudonymous player identifier and session data necessary to operate their games within our platform. They do not receive your full identity or financial details.
• Fraud and AML screening services. We may share transaction data and device fingerprinting data with fraud prevention and AML screening providers for the purpose of detecting and preventing financial crime and bonus abuse.
• Legal and regulatory authorities. We may disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by applicable law or by a valid legal process such as a court order or official information request. In such cases, we will disclose only the information required and, where permitted, will notify you of the request.
• Business transfers. In the event of a merger, acquisition, restructuring, or sale of some or all of gbajo's assets, your personal data may be transferred to the acquiring entity as part of that transaction. In such an event, gbajo will take reasonable steps to ensure that your data continues to be protected under a privacy policy that is substantially equivalent to this one, and will notify registered players of the change where required by law.

gbajo uses cookies and similar tracking technologies (including local storage and session storage) to operate and improve our platform. Cookies are small text files stored on your device when you visit our website. They allow us to recognise your browser across sessions, remember your preferences, maintain your login state, and analyse how different areas of the platform are used.

We use the following categories of cookies:

• Strictly necessary cookies. These are essential for the platform to function. They manage your session authentication, maintain your account login state, handle security tokens, and enable core platform features such as the bet slip and game loader. These cookies cannot be disabled without breaking core functionality.
• Performance and analytics cookies. These cookies collect anonymised or pseudonymised data about how visitors navigate the site — which pages are visited most, how long sessions last, and where errors occur. The data is used solely to improve platform performance and user experience. We use analytics tools that aggregate this data without identifying individual users.
• Functionality cookies. These remember your preferences and settings, such as your preferred language, display settings, and responsible gaming limits that are stored locally for convenience.
• Marketing cookies. Where you have consented, these cookies allow us to track your engagement with gbajo promotions and to present you with relevant offers based on your browsing and betting history. If you withdraw your consent, these cookies will be removed and promotional personalisation will be disabled.

You can manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will impair platform functionality. For browsers that support it, you can use private/incognito browsing mode to limit persistent cookie storage during a session.

gbajo retains your personal data for as long as is necessary to fulfil the purposes described in this policy, subject to any longer retention periods required by applicable law. The following table summarises our standard retention periods by data category:

After the applicable retention period expires, personal data is either permanently deleted from our systems or anonymised so that it can no longer be associated with any individual. We carry out periodic data audits to ensure that data is not retained beyond the periods set out above.

gbajo maintains a comprehensive information security programme designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• Transport Layer Security (TLS/SSL). All data transmitted between your browser or mobile device and our servers is encrypted using 256-bit TLS encryption. The gbajo.io domain is served exclusively over HTTPS.
• Data encryption at rest. Sensitive personal data, including identity documents, payment method details, and account credentials, is stored in encrypted form using industry-standard encryption algorithms.
• Access controls. Access to personal data is restricted on a strict need-to-know basis. Staff members can only access the data categories necessary for their specific role. All access is logged and subject to regular audit.
• Multi-factor authentication. Administrative access to our internal systems requires multi-factor authentication. We also offer and encourage account-level two-factor authentication for players.
• Penetration testing and vulnerability scanning. Our platform undergoes periodic security assessments conducted by independent security professionals to identify and remediate vulnerabilities before they can be exploited.
• Incident response. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, gbajo will take immediate containment steps, investigate the root cause, and notify affected players within a reasonable timeframe in accordance with applicable legal requirements.

While gbajo takes all reasonable technical and organisational steps to protect your data, no internet-based service can guarantee absolute security against all possible threats. You also have a role to play: use a strong, unique password for your gbajo account, do not share your login credentials with anyone, and contact us immediately at [email protected] if you suspect your account has been compromised.

As a data subject, you hold a number of rights in relation to your personal data. gbajo respects these rights and has put processes in place to allow you to exercise them. Your rights are described in detail in the Your Rights section below this content body, and summarised here:

• Right of access. You have the right to request a copy of all personal data gbajo holds about you. We will provide this in a structured, commonly used, machine-readable format within 30 days of receiving a valid request.
• Right to rectification. If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to erasure ("right to be forgotten"). You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests and no overriding interests exist. Note that this right is subject to exceptions — for example, we are required by law to retain financial transaction records for a defined period even if you close your account.
• Right to restrict processing. You may request that we limit how we use your data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to data portability. Where processing is based on your consent or on contractual necessity, you have the right to receive your personal data in a portable format and to transmit it to another service provider.
• Right to object. You have the right to object to processing that is based on legitimate interests, including profiling for responsible gaming monitoring, at any time. gbajo will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent. Where processing is based on your consent — particularly for marketing communications and non-essential cookies — you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

To exercise any of the above rights, please contact our privacy team at [email protected] with the subject line "Data Subject Request" and include your full name, registered email address, and a description of the right you wish to exercise. We will acknowledge your request within 5 business days and respond in full within 30 days.

gbajo sends marketing communications — including promotional offers, bonus announcements, tournament notifications, and personalised betting recommendations — to players who have opted in to receive them. We use the following channels for marketing:

• Email (sent to the address registered on your account)
• SMS (sent to the mobile number registered on your account)
• In-platform notifications (displayed when you are logged in to your gbajo account)

Opting in to marketing communications is voluntary and is not a condition of registering an account or using any gbajo service. You can update your marketing preferences at any time through the Account Settings page, or by clicking the unsubscribe link at the bottom of any promotional email we send you. Following an opt-out request, we will remove you from all marketing lists within 5 business days. Note that transactional communications — such as deposit confirmations, withdrawal notices, KYC request emails, and support responses — are not marketing communications and cannot be opted out of while your account is active, as they are necessary for the operation of your account.

The gbajo platform is strictly for adults aged 21 and above. We do not knowingly collect personal data from any person under the age of 21. Our registration process includes an age declaration step and is backed by KYC age verification checks that require documentary proof of date of birth.

If gbajo becomes aware that a person under the age of 21 has created an account or submitted personal data through our platform, we will immediately suspend the account, void all associated bets and game sessions, return any deposits made to the payment method from which they originated, and permanently delete all personal data collected from that individual from our systems, except where retention is required by law.

If you are a parent or guardian and have reason to believe that a person under your care has accessed the gbajo platform and provided personal data, please contact us immediately at [email protected] with the subject line "Minor Account Report". We will investigate and act on all such reports within 48 hours.

gbajo reserves the right to update, modify, or replace any part of this Privacy Policy at any time. Changes may be made to reflect updates in applicable law, changes to our data processing practices, new services or features we introduce, or feedback from players and regulatory guidance.

When we make material changes to this policy — changes that meaningfully affect your rights or how your data is used — we will notify registered players by email to the address on file at least 14 days before the changes take effect. We will also post a prominent notice on gbajo.io for the same period. For minor or administrative changes that do not affect your rights, we may update the policy without advance notice beyond updating the effective date at the top of the document.

Your continued use of the gbajo platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should stop using the platform and contact [email protected] to request account closure before the effective date of the revision.

We maintain an archive of previous versions of this Privacy Policy. If you wish to review a prior version, please submit a request to [email protected] with the subject line "Privacy Policy Archive Request", specifying the date range you are interested in.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way gbajo handles your personal data, please reach out to our privacy team using the contact details below. We are committed to responding to all privacy-related enquiries promptly and transparently.

Privacy and Data Protection Team
gbajo — Online Betting and Live Casino Platform
Email: [email protected]
Subject line: "Privacy Enquiry" or "Data Subject Request"
Response time: Within 5 business days (Bangladesh Standard Time, UTC+6)

Live chat support is available 24/7 via the Help section of your gbajo account. Our support team handles general privacy enquiries in both English and Bengali. For formal data subject requests, we recommend using email so that we can maintain a written record of the request and our response.