gb22 Privacy Policy

gb22 is an online casino and sports betting platform operated for the Bangladesh market and accessible at https://gb22.io. For the purposes of this Policy, gb22 acts as the data controller — meaning we determine the purposes and means by which your personal data is processed.

Our designated point of contact for all privacy-related enquiries is our support team, reachable at [email protected]. All formal data subject requests, complaints, or data-related correspondence should be directed to this address with the subject line "Privacy Request" to ensure prompt routing to the appropriate team.

gb22 collects personal data in the following categories, depending on how you interact with the Platform:

gb22 collects personal data through the following channels:

• Direct interactions: Information you voluntarily provide when registering an account, completing the KYC process, making a deposit or withdrawal, contacting customer support, or submitting feedback.
• Automated technologies: Technical and usage data collected automatically when you access the Platform, including via cookies, server logs, pixel tags, and similar tracking technologies. See Section 7 for details.
• Payment providers: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, and banking partners when you initiate or complete a financial transaction on the Platform.
• Identity verification providers: Results of identity and document verification checks conducted by our KYC service providers in connection with your account verification.
• Fraud detection services: Risk scoring and device fingerprinting data generated by our fraud prevention partners for the purpose of protecting the Platform and its users.

gb22 processes your personal data on one or more of the following legal grounds:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions — including operating your account, processing deposits and withdrawals, and settling bets.
• Legal obligation: Processing required to comply with applicable anti-money-laundering (AML) regulations, Know Your Customer (KYC) requirements, and other legal duties to which gb22 is subject.
• Legitimate interests: Processing for fraud detection, platform security, responsible gaming monitoring, and service improvement — where our legitimate interests are not overridden by your rights and freedoms.
• Consent: Processing for direct marketing communications, optional personalisation features, and any other processing for which we have specifically requested and obtained your consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

gb22 uses the personal data we collect for the following specific purposes:

• To create, maintain, and administer your gb22 Account and verify your identity in accordance with our KYC obligations.
• To process deposit and withdrawal transactions in BDT via bKash, Nagad, Rocket, Upay, and supported bank transfers.
• To deliver the gaming and sports betting services you request, including settling bets, crediting winnings, and applying bonus funds.
• To detect, investigate, and prevent fraudulent activity, money laundering, collusion, and other prohibited conduct as defined in the Terms & Conditions.
• To monitor and enforce responsible gaming obligations, including applying deposit limits, cooling-off periods, and self-exclusion requests.
• To provide customer support via email and live chat, and to maintain records of support interactions for quality and training purposes.
• To send transactional communications (e.g., deposit confirmations, withdrawal notifications, password reset emails) that are necessary to operate your account. These are not marketing communications and cannot be opted out of while your account is active.
• To send promotional and marketing communications — including bonus offers, new game announcements, and seasonal promotions — only where you have opted in to receive them.
• To conduct analysis and research to improve the Platform, personalise your gaming experience, and develop new features and services.
• To comply with court orders, regulatory requests, or lawful demands from law enforcement authorities.

gb22 does not sell your personal data. We share personal data with third parties only in the following limited circumstances and under strict data-processing agreements:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other financial institutions — solely to process your deposits and withdrawals and to comply with transaction reporting requirements.
• KYC and identity verification providers: Third-party services that assist with document verification, liveness checks, and sanctions screening in connection with our AML compliance obligations.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Ezugi may receive anonymised session data necessary to operate their game servers and generate RNG-certified outcomes. These providers do not receive your name or contact details.
• Fraud prevention and cybersecurity services: Providers that assist gb22 in detecting bot activity, account takeovers, and suspicious transaction patterns.
• IT infrastructure and cloud hosting providers: Services that host the Platform and store data on gb22's behalf, operating under confidentiality and data security obligations.
• Legal and regulatory authorities: Where disclosure is required by law, court order, or a binding request from a competent regulatory or law enforcement authority.

All third-party data processors engaged by gb22 are contractually obligated to process personal data only for the purposes specified by gb22, to implement appropriate technical and organisational security measures, and not to retain personal data beyond the period required to fulfil the contracted service.

gb22 uses cookies and similar tracking technologies on the Platform for the following purposes:

gb22 does not use third-party advertising cookies or tracking pixels for the purpose of delivering targeted advertising on other websites. You may manage functional and analytics cookies via your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from logging in or placing bets.

gb22 retains personal data for as long as necessary to fulfil the purpose for which it was collected, subject to the following minimum retention periods:

• Account and identity data: Retained for the duration of your account and for a minimum of 5 years following permanent account closure, to satisfy AML record-keeping obligations.
• Transaction records (deposits and withdrawals): Retained for a minimum of 5 years from the date of each transaction in accordance with financial record-keeping requirements.
• KYC documents: Retained for a minimum of 5 years from the date of verification. Copies of government-issued documents are stored in encrypted form with restricted access.
• Customer support records: Retained for 3 years from the date of the last interaction, unless a longer period is required in connection with an open dispute or regulatory matter.
• Technical and usage data (logs): Retained for 12 months in aggregate form and 90 days in identifiable form, after which logs are anonymised or deleted.
• Marketing preference records: Retained for the duration of your account. Opt-out records are retained indefinitely to demonstrate compliance with your preferences.

Upon expiry of the applicable retention period, personal data is securely deleted using industry-standard data destruction methods, or anonymised such that it can no longer be linked to an identifiable individual.

gb22 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• Encryption in transit: All data transmitted between your device and the gb22 Platform is encrypted using TLS 1.2 or higher. We enforce HTTPS across all Platform endpoints.
• Encryption at rest: Personal data stored in gb22 databases is encrypted using AES-256 encryption. KYC documents are stored in a separately isolated encrypted vault with access restricted to the compliance team.
• Access controls: Internal access to personal data is governed by role-based access control (RBAC). Only personnel with a verified business need are granted access to personal data, and all access is logged and audited.
• Two-factor authentication (2FA): Available for all player accounts and mandatory for all internal gb22 staff systems that handle personal data.
• Penetration testing: The Platform undergoes periodic security assessments by qualified third-party security professionals to identify and remediate vulnerabilities.
• Incident response: gb22 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected players without undue delay.

Subject to applicable law, you have the following rights in relation to your personal data held by gb22. To exercise any of these rights, contact [email protected] with the subject line "Data Rights Request" and include your registered email address and a description of the right you wish to exercise. We will respond within 30 days.

• Right of access: You may request a copy of the personal data gb22 holds about you, along with information about how it is processed.
• Right to rectification: You may request that inaccurate or incomplete personal data be corrected or completed. You can update many details directly via your account settings without needing to contact support.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations. Note that AML and transaction record-keeping obligations require us to retain certain data for a minimum of 5 years even after account closure.
• Right to restrict processing: You may request that gb22 limits the processing of your personal data in certain circumstances — for example, while a rectification request is being evaluated.
• Right to data portability: You may request a machine-readable export of the personal data you provided to gb22 directly, in a structured, commonly used format (e.g., JSON or CSV).
• Right to object: You may object at any time to processing of your personal data on the basis of legitimate interests, including profiling for marketing purposes. Objections to direct marketing will always be honoured immediately.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

gb22 operates a strict minimum age policy of 21 years for all account holders. The Platform is not directed at, and is not intended for use by, persons under the age of 21. We do not knowingly collect personal data from individuals under 21.

If we become aware that personal data has been collected from a person under the age of 21, we will take immediate steps to close the associated account, void any transactions, and securely delete the personal data in question. If you have reason to believe that a minor has accessed or registered on the Platform using false information, please notify us immediately at [email protected].

gb22 encourages parents and guardians to make use of parental control software and to educate minors about the risks associated with gambling. Responsibility for preventing underage access to online gambling platforms also rests with account holders who must not share their login credentials with any other person, including family members under 21.

The gb22 Platform may contain references or informational links to third-party websites — for example, information about payment providers such as bKash or Nagad, or sports governing bodies such as the Bangladesh Cricket Board or the ICC. This Policy applies solely to the gb22 Platform and not to any third-party websites or services.

gb22 is not responsible for the privacy practices, content, or security of any third-party website. We encourage you to review the privacy policy of any third-party site you visit, particularly before providing your personal data. The inclusion of a reference to a third-party service does not constitute an endorsement of that service's data handling practices.

gb22 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. The date of the most recent revision is displayed at the top of this page.

Where changes are material — meaning they significantly affect the way we process your personal data or affect your rights — gb22 will provide at least 14 days' advance notice by posting a prominent notice on the Platform and, where appropriate, by sending an email notification to registered account holders at their verified email address.

Your continued use of the Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with an update, you should stop using the Platform and may request voluntary account closure by contacting [email protected] before the updated Policy takes effect.

For any questions, concerns, or requests relating to this Privacy Policy or the way gb22 handles your personal data, please contact our support team using the details below. All privacy enquiries are treated as confidential and are handled by personnel with appropriate data protection training.

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data rights requests: "Data Rights Request"
• Subject line for general privacy enquiries: "Privacy Enquiry"
• Response time: We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 days.
• Support hours: 24 hours a day, 7 days a week
• Language: English

gb22 takes all privacy complaints seriously. If you are not satisfied with our response to your enquiry, you retain the right to escalate the matter to the relevant data protection authority or seek legal remedy through the competent courts.