gebaje Privacy Policy

Section 1

Introduction

gebaje is committed to protecting the privacy and personal data of every player who interacts with our platform. As Bangladesh's trusted online casino and sports betting destination, we understand that the information you share with us is sensitive, and we treat it accordingly. This Policy sets out our obligations and your rights in relation to personal data processing in full compliance with internationally recognised data protection principles.

This Policy applies to all personal data collected by gebaje through the following channels: the gebaje website at gebaje.app, the gebaje mobile application (where applicable), communications via email, SMS, or live chat support, and any other interaction you have with gebaje as a platform or organisation. This Policy does not apply to third-party websites, payment providers, or game studios whose own privacy policies govern their respective data practices.

gebaje operates for users aged 18 and above only. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that data has been collected from a minor, we will delete it immediately and close the associated account.

Section 2

Data We Collect

gebaje collects personal data in several ways: directly from you when you register or interact with the platform, automatically through cookies and analytics tools when you browse, and from third-party verification partners as part of our identity and payment verification processes. The categories of data we collect are described below.

Registration & Account Data

• Full legal name as it appears on your national identity document.
• Date of birth (used for mandatory 18+ age verification).
• Mobile phone number (primary contact method and OTP delivery).
• Email address (account communications, bonus notifications, support).
• Residential address (required for identity verification and KYC compliance).
• Username and hashed (encrypted) password.

Payment & Financial Data

• bKash, Nagad, Rocket, or Upay mobile wallet account number (in your name).
• Bank account details where bank transfer is used (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, and others).
• Visa or Mastercard details (card number masked, CVV never stored).
• Transaction history: deposit amounts, withdrawal amounts, dates, and reference codes.
• Source-of-funds documentation where required for large transactions.

Identity Verification (KYC) Data

• Copy of National Identity Card (NID), passport, or driving licence.
• Proof of address documents (utility bill, bank statement) where applicable.
• Selfie or photograph submitted for facial verification purposes.

Technical & Behavioural Data

• IP address and approximate geolocation (city-level, derived from IP).
• Device type, operating system, browser version, and screen resolution.
• Session duration, pages visited, features used, and click-path data.
• Betting and gaming history: wagers placed, games played, outcomes, win/loss data.
• Login timestamps and session activity logs.

Section 3

How We Use Your Data

gebaje processes your personal data only for clearly defined, legitimate purposes. We do not use your data for purposes beyond those listed below without first obtaining your explicit consent. The legal bases on which we rely for processing are: performance of contract, legal obligation, legitimate interests, and (where applicable) your explicit consent.

• Account management: Creating, maintaining, and securing your gebaje account; processing login requests; delivering account-related communications.
• Identity & age verification: Confirming that you are at least 18 years of age and that the personal details you have provided are accurate, as required by our responsible gaming obligations.
• Payment processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, bank transfer, or card through our payment infrastructure partners.
• Fraud prevention and AML compliance: Monitoring transactions and account activity for signs of fraudulent behaviour, money laundering, or other prohibited conduct as outlined in our Terms & Conditions.
• Customer support: Responding to your enquiries, resolving disputes, and providing assistance via email or live chat.
• Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling behaviours and proactively offering support tools such as deposit limits, session reminders, and self-exclusion.
• Platform improvement: Analysing aggregated usage data to improve site performance, navigation, and the overall player experience.
• Marketing communications: Sending you promotional offers, bonus notifications, and seasonal campaigns (e.g., BPL season promotions, Eid offers) — only where you have provided explicit opt-in consent. You may withdraw consent at any time.
• Legal compliance: Retaining records as required by applicable financial, tax, and data protection laws.

Section 4

Data Sharing & Disclosure

gebaje does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We may share your data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

Payment Processing Partners

To facilitate deposits and withdrawals, we share relevant financial data (transaction amount, account reference, payment method identifier) with our payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Visa, and Mastercard. These partners process your financial data under their own privacy policies and data security standards. We do not share your full banking credentials with these partners beyond what is strictly required to complete a transaction.

Identity Verification Providers

For KYC and age verification, gebaje may share document data (NID copy, passport scan, proof of address) with certified third-party identity verification services. These providers are contractually bound to process your data solely for verification purposes and to delete it after the verification process is complete.

Game Technology Providers

Game studios and technology providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) receive a session token and anonymised player identifier to facilitate game play. These providers do not receive your full name, payment details, or contact information unless required for jackpot prize fulfilment.

Legal & Regulatory Disclosure

gebaje may be required to disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies where legally compelled to do so. We will notify you of any such disclosure request where legally permitted.

Section 5

Cookies & Tracking

gebaje uses cookies and similar tracking technologies to operate the platform, maintain your session, and improve your experience. A cookie is a small text file stored on your device by your browser when you visit a website. We use the following categories of cookies:

You can manage your cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent the platform from functioning correctly. To opt out of analytics tracking, adjust your browser's cookie settings or contact our support team at [email protected].

Section 6

Data Retention

gebaje retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The retention periods we apply are based on the nature of the data, the legal obligations we are subject to, and the potential need to retain records for dispute resolution or fraud investigation.

• Active account data: Retained for the full duration of your account and for 5 years following account closure, to allow for dispute resolution and regulatory audits.
• Financial transaction records: Retained for 7 years from the date of each transaction in compliance with financial record-keeping obligations.
• KYC and identity documents: Retained for 5 years post-account closure. Documents are stored in encrypted, access-controlled vaults.
• Support and email correspondence: Retained for 3 years from the date of the last interaction.
• Analytics and behavioural data: Retained on a rolling 13-month basis, after which data is anonymised and aggregated.
• Self-exclusion records: Retained indefinitely to prevent re-registration by self-excluded players, consistent with responsible gaming best practice.

When retention periods expire, personal data is securely deleted or irreversibly anonymised. You may request early deletion of your data subject to the conditions set out in Section 8 of this Policy.

Section 7

Data Security

The security of your personal data is a core priority for gebaje. We implement a comprehensive set of technical and organisational security measures to protect your information from unauthorised access, disclosure, alteration, or destruction.

Despite these measures, no online platform can guarantee 100% immunity from security threats. You share responsibility for account security by maintaining a strong, unique password, enabling any OTP verification offered, and promptly reporting suspected unauthorised access to [email protected].

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, gebaje will notify you without undue delay via the email address registered to your account, and will take immediate steps to contain the breach and mitigate its impact.

Section 8

Your Privacy Rights

As a user of the gebaje platform, you hold a meaningful set of rights in relation to your personal data. gebaje is committed to honouring these rights promptly and transparently. To exercise any of the rights listed below, please contact us at [email protected] with the subject line "Privacy Rights Request".

Section 9

Third-Party Services

The gebaje platform integrates with a number of third-party services to deliver a complete gaming and betting experience. While we carefully select our partners and require them to meet our data protection standards, each third-party provider operates under its own privacy policy. gebaje is not responsible for the data practices of third parties beyond the scope of our contractual data processing agreements.

Payment Providers

bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard each maintain their own data privacy and security standards. When you initiate a payment, you interact directly with these providers' systems. We encourage you to review their respective privacy policies before making transactions.

Game Studios & Technology Providers

Games on the gebaje platform are provided by studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These studios may collect limited technical data (e.g., session identifiers, game outcome logs) for the purpose of game integrity, fairness auditing, and RNG certification. They do not receive your personally identifiable information.

Analytics & Performance Tools

gebaje uses website analytics tools to monitor platform performance and user experience. Any data shared with analytics providers is pseudonymised and aggregated. We do not share raw personal data with analytics services, and we have data processing agreements in place with all analytics partners.

Section 10

Policy Updates

gebaje reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. We are committed to communicating any material changes to you in a timely and transparent manner.

• The "Last updated" date at the top of this page will be revised each time this Policy is amended.
• For material changes — those that significantly affect your rights or how we use your data — gebaje will notify you by email at the address registered to your account at least 7 days before the change takes effect.
• Minor clarifications, corrections of typographical errors, or formatting changes that do not alter the substance of this Policy may be made without advance notice.
• Your continued use of the gebaje platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.
• If you do not agree with any amendment to this Policy, you should discontinue use of the platform and contact [email protected] to request account closure and data deletion (subject to legal retention obligations).

Section 11

Contact & Data Requests

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to report a privacy concern, please contact the gebaje data protection team using the details below. We aim to acknowledge all privacy-related enquiries within 48 hours and to resolve them within 30 calendar days.

When submitting a data rights request, please include your full name, registered email address, and a clear description of the right you wish to exercise. We may need to verify your identity before processing your request to ensure we are disclosing or deleting data belonging to the correct individual.