gvaji Privacy Policy

This Privacy Policy ("Policy") describes how gvaji ("gvaji", "we", "us", "our"), the operator of the online gaming platform at gvaji.pro, collects, uses, stores, shares, and protects personal data relating to users ("Player", "User", "you") of our platform. This Policy applies to all personal data collected through the gvaji website, any related mobile-optimised interface, and all communications between gvaji and its registered players, including support correspondence and promotional communications.

By registering an account on gvaji or by continuing to use the gvaji platform, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, please do not use the gvaji platform. This Policy should be read alongside our Terms and Conditions and our Responsible Gaming Policy.

gvaji collects personal data across four main categories. We collect only the data that is necessary for the stated purposes and do not collect excessive or irrelevant information.

gvaji uses the personal data it collects for the following specific purposes:

• Account registration and management: creating and maintaining your gvaji player account, verifying your identity and age (21+), processing password resets, and managing account closure or suspension requests.
• Payment processing: verifying and processing BDT deposits and withdrawals via bKash, Nagad, Rocket, and Upay; confirming that the payment account is registered in your own name; and maintaining transaction records for reconciliation purposes.
• Fraud prevention and security: monitoring account activity for signs of fraud, money laundering, collusion, or other prohibited conduct; conducting KYC and AML checks as required; and taking action to protect the integrity of the platform.
• Responsible gaming: using gaming activity data to identify patterns consistent with problem gambling and, where appropriate, proactively offering responsible gaming tools including deposit limits, time-out options, and self-exclusion.
• Customer support: responding to support queries sent to [email protected], resolving account disputes, investigating complaints, and maintaining records of support interactions for quality-assurance purposes.
• Platform improvement and personalisation: analysing aggregated usage data to improve the gvaji platform's performance, game selection, and user experience; and, where you have opted in, providing personalised promotional communications including seasonal offers for Eid, BPL season, and Pohela Boishakh.

gvaji does not use your personal data for automated decision-making that produces legal or similarly significant effects without human oversight. Where automated systems are used for fraud detection or responsible gaming monitoring, a human review process is available upon request.

gvaji processes personal data on the following legal bases, depending on the nature and purpose of the processing activity:

• Contractual necessity: processing your identity, contact, financial, and gaming activity data is necessary to provide you with the services described in the gvaji Terms and Conditions — specifically, to operate your account, process payments, and settle bets. Without this processing, we cannot provide these core services.
• Legal obligation: certain processing activities — including identity verification, age verification (21+), anti-money laundering checks, and the maintenance of transaction records — are required by applicable financial services and anti-money laundering regulations.
• Legitimate interests: processing technical and usage data for platform security, fraud prevention, and responsible gaming monitoring is carried out on the basis of gvaji's legitimate interest in maintaining a safe, fair, and well-functioning platform for all players.
• Consent: where gvaji sends you optional promotional communications (e.g. bonus offers, seasonal promotions for BPL or Eid), this processing is carried out on the basis of your consent. You may withdraw your consent to receive promotional communications at any time by contacting [email protected].

When you make a deposit or withdrawal, gvaji receives a transaction confirmation reference from your mobile wallet provider (bKash, Nagad, Rocket, or Upay) confirming that the transaction was completed. gvaji records the last four digits or partial identifier of the sending wallet account number alongside the transaction reference, amount, and timestamp. This partial payment identifier is used solely for account reconciliation, dispute resolution, and compliance with anti-money laundering requirements — it cannot be used to access your mobile wallet.

gvaji requires that all deposits and withdrawals are made from a bKash, Nagad, Rocket, or Upay account registered in the same name as the gvaji account. This is both a security measure and a regulatory requirement. Attempts to use payment accounts registered in a different name will be declined and may trigger an account review.

gvaji uses cookies and similar tracking technologies to operate and improve the platform. The following categories of cookies are used:

• Essential cookies: these are required for the platform to function correctly and cannot be disabled. They include session authentication tokens (which keep you logged in during a session), CSRF protection tokens (which prevent cross-site request forgery attacks), and load-balancing cookies (which ensure your session is routed to the same server consistently).
• Analytics cookies: these collect anonymised data about how players interact with the gvaji platform — including which pages are visited most frequently, how long sessions last, and which device types are most common. This data is used in aggregate to improve platform performance and user experience. Individual players are not identifiable from analytics data.
• Preference cookies: these remember your in-session platform preferences such as language display settings. They do not collect or transmit personally identifiable information beyond the preference value itself.

Most mobile browsers allow you to control cookie settings through the browser's privacy or settings menu. Disabling essential cookies will prevent the gvaji platform from functioning correctly and will result in your inability to log in or place bets. Disabling analytics or preference cookies will not affect your ability to use the core platform features.

gvaji does not sell, rent, or trade your personal data. We share personal data with third parties only in the following limited and specific circumstances:

• Licensed game providers: gvaji's casino games are provided by licensed third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you launch a game, a session token is passed to the relevant game provider's server. This token identifies your account to the game server but does not include your full name, contact details, or payment information. Game providers operate under their own data processing agreements and are bound by applicable data protection standards.
• Payment processors: transaction data is shared with bKash, Nagad, Rocket, and Upay solely to initiate, verify, and confirm payment transactions. The payment provider receives the transaction amount in BDT, a transaction reference, and your registered wallet identifier. No casino gaming data or betting history is shared with payment providers.
• Fraud prevention and compliance service providers: gvaji may share limited personal data (such as IP address, device fingerprint, and transaction patterns) with third-party fraud detection and KYC/AML compliance service providers. These providers are contractually bound to use this data only for the purpose of providing their services to gvaji and are prohibited from using it for any other purpose.
• Legal and regulatory disclosure: gvaji may disclose personal data to law enforcement agencies, regulatory bodies, or courts where it is required to do so by applicable law, by a valid court order, or in connection with the investigation or prevention of financial crime. In such cases, gvaji will disclose only the minimum data necessary to comply with the legal requirement.

All third parties with whom gvaji shares personal data are required to implement appropriate technical and organisational security measures to protect that data. gvaji does not transfer personal data to countries outside Bangladesh except where required by the game provider or compliance service arrangements described above, and in all such cases appropriate data protection safeguards are in place.

gvaji retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law. The following general retention periods apply: account and identity data is retained for the duration of the active account relationship and for a period of five years following account closure; financial and transaction data is retained for a minimum of seven years from the date of the transaction to comply with financial record-keeping requirements; gaming activity data is retained for five years from the date of the activity; technical and usage data (logs) are retained for a rolling period of 12 months, after which they are automatically deleted or anonymised.

Following the expiry of the applicable retention period, gvaji will securely delete or anonymise your personal data so that it can no longer be linked to you as an individual. Where data is anonymised rather than deleted, the anonymised data may be retained indefinitely for statistical or analytical purposes, as it no longer constitutes personal data.

gvaji implements a range of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Key security measures include: 256-bit SSL/TLS encryption for all data transmitted between your device and the gvaji platform; encryption of sensitive data fields at rest in our databases; strict access controls limiting internal access to personal data to authorised personnel on a need-to-know basis; regular security audits and vulnerability assessments of the gvaji platform infrastructure; and secure logging and monitoring of all administrative access to player data systems.

While gvaji takes all reasonable steps to protect your personal data, no data transmission over the internet or mobile network can be guaranteed as completely secure. You are responsible for maintaining the security of your own device, keeping your gvaji login credentials confidential, and logging out of the platform when using shared devices. If you believe your account has been compromised, contact [email protected] immediately.

As a gvaji player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact [email protected] with the subject line "Data Rights Request" and your registered account identifier. We will respond within 14 days of receiving your request.

gvaji will not discriminate against you for exercising any of the data rights described above. Exercising your rights will not affect your ability to use the gvaji platform, subject to any necessary consequences that are inherent to the right itself (for example, requesting account erasure will result in account closure).

Upon receiving a verified report that a minor has accessed the gvaji platform, we will immediately suspend the relevant account, delete all personal data associated with the minor as permissible under our legal retention obligations, and refund any deposits made to the payment account from which they originated. gvaji's age verification processes are designed to minimise the risk of underage access, and all accounts are subject to ongoing monitoring for indicators of underage play.

The gvaji platform integrates games and content from licensed third-party providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you launch a game provided by one of these studios, you are interacting with a game environment hosted on that studio's infrastructure. gvaji is not responsible for the data practices of its game provider partners beyond the scope of the data processing agreements in place with those providers. Each game provider operates under its own privacy policy and data protection framework. gvaji selects game providers that meet applicable data protection and security standards, but players who wish to understand how a specific provider handles their session data should refer to that provider's own privacy documentation.

gvaji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory guidance. When we make material changes to this Policy, we will update the "Last updated" date at the top of this page. Where required, we will notify registered players of significant changes via the platform or by email to the registered account address.

Your continued use of the gvaji platform after any update to this Policy constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically so that you remain aware of how your personal data is being handled. The current version of this Policy is always available at gvaji.pro/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data gvaji holds about you, please contact our support team. All privacy-related queries are handled confidentially and will be responded to within 14 days of receipt.

Email: [email protected] — Please include "Privacy Policy Query" or "Data Rights Request" in your subject line, along with your registered mobile number or account identifier, so we can locate your account and respond efficiently. For data rights requests, please also specify which right you wish to exercise (access, rectification, erasure, restriction, or objection).