gibaji Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how gibaji ("the Platform", "we", "us", "our") collects, uses, stores, discloses and protects personal information submitted by users ("you", "your", "the Player") when accessing or using any feature of the gibaji website at gibaji.club, including account registration, deposits and withdrawals, sports betting, casino gaming, and any associated communications or support interactions.

By creating a gibaji account or continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should cease using the platform and contact our support team to arrange account closure.

This Policy should be read alongside gibaji's Terms & Conditions and Responsible Gaming policy, both of which form part of your agreement with the platform.

2 Information We Collect

gibaji collects personal information through several channels. The categories of data we collect are outlined below:

2.1 Registration & Identity Data

When you create a gibaji account, we collect the information you provide directly, including:

• Full legal name
• Date of birth (to verify you are 18 or older)
• Residential address (city, district, Bangladesh)
• Mobile phone number (your primary contact and payment identifier)
• Email address
• Username and password (password stored in hashed form only)

2.2 Identity Verification (KYC) Documents

As part of our Know Your Customer ("KYC") process, we may request and retain copies of:

• National Identity Card (NID) or passport
• Proof of address (utility bill, bank statement dated within three months)
• Proof of mobile wallet ownership (screenshot or statement from bKash, Nagad or Rocket)
• Selfie photograph for liveness verification where required

2.3 Financial Transaction Data

Every deposit and withdrawal processed through your gibaji account generates a transaction record that includes the amount, method (bKash, Nagad, Rocket or Upay), timestamp, and transaction reference number. We do not store your full mobile wallet PIN or password — transaction authorisation occurs directly within your mobile financial service app.

2.4 Gameplay & Betting Data

We record the details of all bets placed, games played, session durations, wagering volumes, win/loss history and bonus usage. This data is used for account management, dispute resolution, responsible gaming monitoring, and platform improvement.

2.5 Technical & Device Data

When you access gibaji, our servers automatically log certain technical information, including:

• IP address and approximate geolocation (city level)
• Device type, operating system and browser version
• Session start/end timestamps
• Pages and features accessed within the platform
• Referral source (if you arrived via a tracked link)

2.6 Communications Data

If you contact gibaji's support team via live chat or email, we retain records of those communications, including the content of messages and any attachments, to allow us to review and resolve your query and to maintain a record of interactions for quality and compliance purposes.

3 How We Use Your Data

gibaji uses the personal information we collect for the following purposes:

Purpose	Data Used
Account creation and management	Registration data, identity documents
Processing deposits and withdrawals	Mobile number, transaction data, KYC documents
Age and identity verification (KYC)	Date of birth, NID/passport, selfie
Fraud detection and prevention	Technical data, transaction history, gameplay data
Responsible gaming monitoring	Session data, wagering history, deposit patterns
Customer support	Communications data, account data
Legal and regulatory compliance	All categories as required
Platform improvement and analytics	Technical data, gameplay data (aggregated/anonymised)
Promotional communications (opt-in only)	Email address, mobile number, gameplay preferences

4 Legal Basis for Processing

gibaji processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to create and manage your account, process transactions, and deliver the services you have requested.
• Legal obligation: Processing required to comply with anti-money laundering (AML) regulations, KYC requirements, and any applicable financial reporting obligations.
• Legitimate interests: Processing to detect and prevent fraud, protect the security of the platform, and improve our services — balanced against your rights and expectations as a player.
• Consent: Processing for optional purposes such as marketing communications, where you have provided clear, freely given consent that can be withdrawn at any time.

5 Data Sharing & Disclosure

gibaji does not sell, rent or trade your personal data to any third party for commercial purposes. Your data may be shared in the following limited circumstances:

5.1 Payment Processors

To process deposits and withdrawals, gibaji shares relevant transaction details — including your mobile number and transaction amount — with mobile financial service providers bKash, Nagad, Rocket and Upay. These providers operate under their own privacy policies and are bound by contractual obligations to handle your data securely and only for the stated transaction purpose.

5.2 Game Technology Providers

The casino games available on gibaji are powered by third-party providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe and Ezugi. These providers may receive a player identifier and session token to deliver the game experience. They do not receive your full name, mobile number or financial data.

5.3 Legal and Regulatory Disclosures

gibaji may disclose your personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by applicable law, a valid legal order, or where we have reasonable grounds to believe such disclosure is necessary to prevent fraud, money laundering, or other criminal activity.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of gibaji's business assets, player data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to this Privacy Policy that result from it.

6 Payment Data & Mobile Wallet Security

gibaji is fully integrated with Bangladesh's leading mobile financial services — bKash, Nagad, Rocket and Upay — to provide seamless, instant deposits and withdrawals for Bangladeshi players. The security of payment data is treated with the highest level of care across all transaction flows.

When you initiate a deposit or withdrawal on gibaji, the payment authorisation step occurs directly within your mobile wallet application. gibaji does not have access to, nor does it store, your bKash PIN, Nagad PIN, Rocket PIN, or any other mobile wallet authentication credential. Transaction confirmation is received from the payment provider via a secure API callback after authorisation is completed on your device.

All payment transaction records retained by gibaji — including amounts, dates, reference numbers and associated mobile numbers — are stored in encrypted form and accessible only to authorised gibaji finance and compliance personnel with a documented business need.

7 Cookies & Similar Technologies

7.1 What Are Cookies

Cookies are small text files placed on your device by a website when you visit it. They allow the website to remember certain information about your visit, improving functionality and user experience. gibaji uses cookies and similar technologies (such as local storage and session tokens) on the gibaji.club platform.

7.2 Types of Cookies We Use

• Essential cookies: Required for core platform functionality — session authentication, maintaining your logged-in state, and securing your account from CSRF attacks. These cannot be disabled without breaking the platform.
• Functional cookies: Store your preferences such as display settings and language preferences so you do not need to set them on every visit.
• Analytics cookies: Allow us to understand how players navigate the platform in aggregate — which pages are visited most frequently, where users encounter difficulties, and how overall usage patterns evolve over time. This data is anonymised before analysis.

7.3 Managing Cookies

You can control or delete cookies through your browser's settings. Please note that disabling essential cookies will prevent you from logging in to your gibaji account and using key platform features. Functional and analytics cookies can be disabled without affecting your ability to place bets or access your account, though some preferences may not be saved between sessions.

8 Data Security

gibaji implements a layered approach to data security, combining technical, organisational and procedural safeguards to protect your personal information against unauthorised access, accidental loss, and unlawful processing:

• TLS/SSL encryption: All data transmitted between your device and the gibaji platform is encrypted using industry-standard Transport Layer Security protocols.
• Encrypted data storage: Sensitive personal data fields — including identity document images and financial records — are stored using strong encryption at rest.
• Access controls: Access to personal data is restricted to gibaji personnel who have a demonstrated business need. Role-based access controls and audit logs are maintained for all data access events.
• Fraud monitoring: Automated systems monitor transaction patterns and login behaviour in real time to detect and flag suspicious activity, protecting both player accounts and platform integrity.
• Incident response: gibaji maintains a documented data breach response procedure. In the event of a breach that poses a material risk to your rights and freedoms, affected players will be notified promptly.

9 Data Retention

gibaji retains your personal data for as long as your account remains active and for a defined period thereafter, in accordance with our legal and operational obligations:

• Active account data: Retained for the full duration of your account's existence on the platform, updated as your information changes.
• Post-closure retention: Following account closure, your registration details, KYC documents and transaction history are retained for a minimum of five (5) years to comply with anti-money laundering legislation and financial record-keeping requirements.
• Support communications: Retained for two (2) years from the date of the interaction, unless the communication relates to a formal dispute or legal matter, in which case it is retained for the duration of that proceeding plus two years.
• Technical log data: Server and access logs are retained for ninety (90) days for security monitoring purposes, then automatically purged.
• Marketing preferences: Retained for as long as you hold an account. Deleted upon account closure or earlier if you withdraw consent.

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised such that it can no longer be linked to you as an individual.

10 Your Rights Over Your Data

As a gibaji player, you have the following rights in relation to your personal data. To exercise any of these rights, contact our support team via live chat or at [email protected]:

• Right of access: You may request a copy of the personal data gibaji holds about you. We will provide this within 30 days of receiving a valid request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct it promptly.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. We cannot delete data that we are required to retain by law.
• Right to restrict processing: In certain circumstances, you may ask us to suspend processing of your data while a concern is investigated — for example, if you believe data we hold is inaccurate.
• Right to data portability: Where processing is based on your consent or a contract with you, you may request that we provide your data in a structured, machine-readable format.
• Right to withdraw consent: Where processing relies on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to object: You may object to processing of your data for legitimate interests purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.

11 Children's Privacy

gibaji is strictly an 18+ platform and is not directed at, nor intended for use by, any person under the age of eighteen (18). We do not knowingly collect personal data from minors. Age verification is conducted as part of our KYC process to confirm that all registered players meet the minimum age requirement.

If we become aware that personal data has been submitted by or on behalf of a person under the age of 18, we will immediately suspend the associated account, delete all related personal data, and — if applicable — return any deposited funds to the source wallet after completing required AML checks.

If you believe that a minor may have registered on the gibaji platform, please contact us immediately at [email protected] so that we can take prompt action.

12 Changes to This Privacy Policy

gibaji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. When we make material changes to this Policy, we will notify registered players via the email address on file or via a prominent notice on the platform before the changes take effect.

The date at the top of this Policy indicates when it was last revised. Your continued use of the gibaji platform following notification of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree with any changes, you should cease using the platform and contact support to arrange account closure.

13 Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or gibaji's data practices, please reach out to our team through any of the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 directly within the gibaji platform
• Response Time: We aim to acknowledge all privacy-related enquiries within 24 hours and to resolve them within 30 days of receipt
• Operating Timezone: Bangladesh Standard Time (BST, UTC+6)

When submitting a data rights request, please include your registered username and the email address associated with your account so that we can locate your records and verify your identity before acting on the request.