gdaje Privacy Policy — How We Handle Your Personal Data

gdaje collects personal data in two ways: information you provide directly, and information collected automatically when you use the platform. The following table summarises the categories of personal data we collect, the source of that data, and the lawful basis on which we process it.

gdaje does not collect personal data from individuals known to be under the age of 18. If we discover that personal data has been collected from an individual who is under 18, that data will be deleted immediately and the associated account permanently closed.

gdaje uses the personal data we collect for the following specific, documented purposes. We do not use your data for any purpose that is incompatible with those listed below without first obtaining your explicit consent or establishing a fresh lawful basis.

• Account Creation and Management: Processing your registration, verifying your identity and age, maintaining your account profile, and enabling login access to the gdaje platform.
• Transaction Processing: Receiving and recording deposits via bKash, Nagad, Rocket, and Upay; processing withdrawal requests to your registered payment account; maintaining an accurate account balance.
• Regulatory Compliance: Fulfilling Know Your Customer (KYC) obligations, conducting anti-money-laundering (AML) checks, retaining transaction records as required by applicable law, and cooperating with lawful requests from authorities.
• Fraud and Security: Detecting and preventing fraudulent account activity, unauthorised access attempts, collusion, bonus abuse, and other prohibited conduct as defined in the gdaje Terms & Conditions.
• Responsible Gaming: Monitoring betting and deposit patterns to identify indicators of problem gambling; applying self-exclusion restrictions and deposit limits as requested; contacting players where our responsible gaming monitoring flags a concern.
• Customer Support: Responding to your queries, resolving disputes, maintaining records of support interactions for quality-assurance purposes.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve game selection, platform performance, user experience, and payment processing reliability.
• Marketing Communications: Sending promotional emails, SMS messages, and in-platform notifications about offers, bonuses, and seasonal promotions — only where you have given explicit consent and only until consent is withdrawn.
• Personalisation: Where you have consented, using your game and betting history to surface relevant content, promotions, and recommendations within the gdaje platform.

gdaje does not sell your personal data. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

• Payment Processing Partners: Financial transaction data is shared with mobile money operators (bKash, Nagad, Rocket, Upay) and any intermediary payment processors strictly for the purpose of executing deposits and withdrawals requested by you.
• Identity Verification Providers: During KYC verification, identity document data may be shared with authorised third-party identity verification service providers operating under formal data processing agreements with gdaje.
• Game and Technology Providers: To facilitate gameplay, technical session data (such as player ID and session token) is shared with game studios and platform technology providers (including Pragmatic Play, Evolution Gaming, Spribe, and others). These providers do not receive personally identifiable contact or financial information beyond what is required to operate the game session.
• Fraud Prevention and AML Services: gdaje may share account and transaction data with specialist fraud-detection and anti-money-laundering service providers for the purpose of protecting the integrity of the platform and its players.
• Legal and Regulatory Authorities: gdaje will disclose personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, or where gdaje reasonably believes such disclosure is necessary to protect the rights or safety of any person.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of the gdaje business, personal data held on registered players may be transferred to the acquiring entity as part of the transaction, subject to the acquiring entity assuming gdaje's obligations under this Privacy Policy.

gdaje uses cookies and similar tracking technologies (including local storage objects and session tokens) to operate and improve the platform. A cookie is a small text file stored on your device by your browser when you visit a website. Cookies allow gdaje to recognise your device, maintain your session state, and gather usage analytics.

The following categories of cookies are used on the gdaje platform:

You can manage cookie preferences through your browser settings. Most modern browsers allow you to block, delete, or receive notifications about cookies. Note that disabling strictly necessary cookies will prevent the gdaje platform from functioning correctly, and you will be unable to maintain an authenticated session.

gdaje retains personal data for as long as is necessary to fulfil the purpose for which it was collected, and thereafter for as long as required by applicable law or legitimate business need. The following retention periods apply as a baseline:

• Account and Identity Data: Retained for the life of the account plus a minimum of five years following account closure. This retention period is required to satisfy anti-money-laundering record-keeping obligations and to enable gdaje to respond to any post-closure regulatory enquiry or dispute.
• Transaction Records: All deposit and withdrawal records, including amounts, timestamps, and payment method references, are retained for a minimum of seven years following each transaction. This reflects standard financial record-keeping requirements.
• KYC Documents: Identity documents submitted for KYC verification are retained for the life of the account plus five years following closure. Documents are stored in an encrypted vault and access is restricted to authorised compliance personnel only.
• Support and Communication Records: Live chat transcripts, support emails, and dispute records are retained for three years following the closure of the relevant support interaction. These records may be retained for longer where the subject matter relates to an ongoing dispute or regulatory investigation.
• Marketing Consent Records: Records of your marketing consent (including the date consent was given or withdrawn) are retained for the life of the account and for three years after account closure, to enable gdaje to demonstrate compliance with consent obligations.
• Analytics and Usage Data: Anonymised and aggregated usage analytics data may be retained indefinitely as it can no longer be used to identify any individual. Non-anonymised usage logs are deleted or anonymised within 13 months of collection.

When personal data is no longer required for any of the purposes listed above, it is securely deleted or permanently anonymised. gdaje conducts periodic data audits to identify and remove data that has exceeded its applicable retention period.

gdaje employs a layered, defence-in-depth approach to protecting the personal data of Bangladesh players. The following technical and organisational security measures are in place across the gdaje platform and infrastructure:

• 256-bit SSL/TLS Encryption: All data in transit between your device and gdaje servers is encrypted using industry-standard Transport Layer Security. Our SSL certificate is maintained and renewed on a regular schedule.
• Encrypted Data at Rest: Personal data and financial records stored in gdaje databases are encrypted at rest. Encryption keys are managed using a dedicated key management system with role-based access controls.
• Two-Factor Authentication (2FA): gdaje supports 2FA for player account login, adding a second verification layer via one-time code sent to your registered mobile number. gdaje staff with access to production systems are required to use 2FA at all times.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Only authorised personnel in relevant roles (compliance, customer support, finance) can access player data, and all access events are logged for audit purposes.
• Intrusion Detection and Monitoring: gdaje operates continuous security monitoring across its infrastructure, including intrusion detection systems, anomaly detection, and real-time alerting for suspicious access patterns.
• Third-Party Security Audits: The gdaje platform undergoes periodic independent security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a confirmed personal data breach that poses a risk to affected individuals, gdaje will notify affected players as promptly as practicable via their registered email address, describing the nature of the incident, the data affected, and the steps taken to contain it.

As a registered gdaje player, you hold the following rights in respect of your personal data. These rights can be exercised at any time by contacting gdaje support via live chat. gdaje will respond to all data rights requests within 30 calendar days of receipt.

To exercise any of the rights listed above, contact gdaje support via live chat or send a written request to [email protected] (plain text — not a link). Please include your registered name, account username, and a description of the right you wish to exercise. gdaje may request proof of identity before processing a data rights request to prevent unauthorised disclosure.

gdaje reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, updates to platform functionality, changes in data processing practices, or recommendations from data protection authorities. The date of the most recent revision is displayed at the top of this page and in the version history below.

For material changes — those that could affect your rights or the way your data is used — gdaje will notify registered players via their registered email address at least seven calendar days before the change takes effect. For non-material changes such as typographic corrections or clarifications that do not alter the substance of any provision, the updated policy will be published without advance notice.

Your continued use of the gdaje platform after the effective date of any revision constitutes acceptance of the updated Privacy Policy. If you do not accept the revised policy, you must cease using the platform and may request voluntary account closure in accordance with the gdaje Terms & Conditions.

We encourage all registered players to review this Privacy Policy periodically. The current version is always accessible via the footer link on every page of the gdaje platform.