gbd22 Privacy Policy — How We Handle Your Data

When you create a gbd22 account, we collect the following information to set up and manage your account:

• Full name, date of birth, and gender (as provided at registration).
• Mobile phone number and, if provided, email address — used for account login, two-factor authentication, and communications.
• Residential address (city or district level, as provided) — used for fraud screening and responsible gaming assessments.
• Identity verification documents (National ID or equivalent) — collected as part of KYC verification before withdrawals are processed.

To process deposits and withdrawals and to comply with anti-money laundering (AML) obligations, gbd22 collects:

• Payment method identifiers — such as your bKash wallet number, Nagad account reference, Rocket number, or the last four digits of a card. gbd22 does not store full card numbers.
• Transaction records: deposit amounts, withdrawal amounts, dates, payment method used, and transaction reference numbers.
• Source-of-funds documentation where required by applicable AML obligations or where gbd22's risk assessment process determines it is necessary.

When you access gbd22, our servers and analytics systems automatically collect technical information about your session. This includes your IP address, the type and version of your browser, your device operating system, screen resolution, the pages you visit within gbd22 and the time spent on each, clickstream data (the sequence of pages and features you interact with), and the date and time of your session. This data is collected in aggregate and is used to maintain platform security, detect suspicious access patterns, improve site performance, and understand how users navigate gbd22 so we can prioritise improvements. We do not use IP addresses to identify you personally — they are used for fraud prevention and geographic access controls only.

• Account creation, maintenance, and security — verifying your identity, managing your login credentials, and protecting your account from unauthorised access.
• Payment processing — enabling deposits via bKash, Nagad, Rocket, and other supported payment methods, and processing withdrawal requests to your registered payment account.
• Legal and regulatory compliance — fulfilling KYC obligations, meeting AML screening requirements, and responding to lawful requests from competent authorities.
• Customer support — responding to your queries, resolving account issues, and processing complaints through our support channels.
• Responsible gaming — monitoring play patterns to identify potentially problematic gambling behaviour and, where appropriate, proactively contacting players who may benefit from self-management tools or support resources.

gbd22 may send you promotional communications about bonuses, new game releases, cricket betting markets, and seasonal offers (for example, around BPL, IPL, Eid, and Pohela Boishakh) where you have opted in to receive such communications. You may withdraw your consent to marketing communications at any time by contacting support or using the opt-out mechanism in any marketing message. Withdrawing consent to marketing does not affect your ability to use gbd22 — it only stops promotional messages. gbd22 will continue to send you service-essential communications (for example, deposit confirmations, withdrawal notifications, and security alerts) regardless of your marketing preference.

gbd22 uses the following categories of cookies and similar tracking technologies on the platform:

• Essential cookies — these are required for the platform to function. They maintain your login session, remember your language preference, and enable secure navigation between pages. These cookies cannot be disabled without breaking core platform functionality.
• Analytics cookies — these collect anonymised usage data (such as which pages are visited most frequently and where users encounter errors) to help gbd22 improve platform performance and user experience. Analytics data is processed in aggregate and is not linked to individual user identities.
• Security cookies — these are used for fraud detection and to identify suspicious session behaviour, such as multiple failed login attempts or access from unusual geographic locations.

You can control and delete cookies through your browser settings. Most modern mobile browsers (including Chrome on Android and Safari on iOS) allow you to block or clear cookies from a specific site. Please note that disabling essential cookies will prevent you from logging in to gbd22 and using core platform features. Disabling analytics or security cookies will not prevent you from using the platform but may affect our ability to detect fraud or improve your experience. gbd22 does not use third-party advertising cookies or retargeting pixels.

gbd22 implements technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include 256-bit SSL/TLS encryption for all data transmitted between your browser and our servers, encrypted storage of sensitive account data at rest, access controls that restrict which gbd22 staff members can view personal account data (limited to those with a legitimate operational need), regular security assessments of platform infrastructure, and automatic session timeouts after periods of inactivity. No security system is infallible. In the unlikely event of a data breach that is likely to result in a high risk to your rights and freedoms, gbd22 will notify affected users without undue delay.

gbd22 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention period required by applicable law. The following retention periods apply: active account data is retained for the duration of the account plus 5 years after closure (to satisfy AML and financial record-keeping obligations); KYC documents are retained for 5 years after the end of the customer relationship; transaction records are retained for 5 years from the date of the transaction; support correspondence is retained for 2 years from the date of resolution. When data is no longer required to be retained, it is securely deleted or anonymised.

gbd22 operates servers that may be located outside Bangladesh. Where your personal data is transferred to and processed in a country other than Bangladesh, gbd22 ensures that appropriate safeguards are in place to protect your data, including contractual data processing agreements with service providers that require them to maintain data protection standards equivalent to those described in this Privacy Policy. By using gbd22, you acknowledge that your data may be transferred and stored in jurisdictions outside Bangladesh where data protection laws may differ.

• Right of access — you may request a copy of all personal data gbd22 holds about you, including account data, transaction records, and any KYC documents on file.
• Right to rectification — if any personal data gbd22 holds about you is inaccurate or incomplete, you may request that it be corrected. You can update most account details directly from your account settings.
• Right to erasure — you may request deletion of your personal data after closing your gbd22 account, subject to gbd22's legal data retention obligations. Data required to be retained under applicable AML, KYC, or financial record-keeping law cannot be erased before the end of the applicable retention period.
• Right to restrict processing — in certain circumstances (for example, while a dispute about the accuracy of your data is being resolved), you may request that gbd22 restrict processing of your personal data to storage only.
• Right to object to marketing — you may withdraw consent to marketing communications at any time. This will not affect your ability to use the platform or receive service-essential communications.