gd22 Privacy Policy

1 Introduction and Scope

gd22 ("gd22", "we", "us", "our") is committed to protecting the privacy and personal data of every individual who visits, registers on, or interacts with the gd22 platform at https://gd22.io (the "Platform"). This Privacy Policy explains in clear, plain English how we collect personal data, the purposes for which we use it, how long we keep it, who we share it with, and the rights available to you as a data subject.

This Policy applies to all personal data processed in connection with your use of the Platform, including data collected when you browse as a guest, register an account, make deposits or withdrawals, place bets, contact our support team, or interact with any feature of the gd22 service. It does not apply to third-party websites that may be linked from the Platform — those sites are governed by their own privacy policies.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you should discontinue use of the Platform. This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, which together form the complete set of agreements governing your relationship with gd22.

2 Data Controller

For the purposes of this Privacy Policy, gd22 acts as the data controller in respect of all personal data collected from players who access the Platform from Bangladesh. As data controller, gd22 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

All enquiries regarding gd22's data processing activities — including requests to exercise data subject rights as described in Section 10 — should be directed to the gd22 support team using the contact details set out in Section 13 of this Policy. gd22 will respond to all privacy-related enquiries within a reasonable timeframe and in no case later than thirty (30) calendar days of receiving a clearly worded written request.

3 Personal Data We Collect

The table below summarises the categories of personal data that gd22 may collect and hold about you, together with specific examples of the data items within each category.

4 How We Collect Your Data

gd22 collects personal data through the following channels:

• Direct Collection — Registration: When you create a gd22 account, you provide your name, email address, mobile number, date of birth, and preferred payment method. This data is entered directly by you into the registration form on the Platform.
• Direct Collection — KYC Submission: When you submit identity documents to complete the Know Your Customer (KYC) verification process prior to your first withdrawal, gd22 collects the document images and the personal data visible on those documents.
• Direct Collection — Deposits and Withdrawals: When you process a financial transaction via bKash, Nagad, Rocket, or Upay, gd22 receives transaction confirmation data from the relevant mobile financial service provider, including the transaction reference number and the amount transferred.
• Direct Collection — Support Interactions: When you contact gd22's support team via live chat or email, gd22 retains a record of that communication, including your username, the nature of your query, and any account or transaction information you share during the interaction.
• Automated Collection — Technical Data: When you access the Platform, gd22's servers automatically log technical data including your IP address, browser fingerprint, device identifiers, pages visited, time on page, and clickstream data. This data is collected via server logs and first-party analytics tools.
• Automated Collection — Cookies: gd22 uses cookies and similar technologies to maintain your logged-in session state and to collect aggregated, anonymised usage statistics. See Section 7 for a full breakdown of cookies used.
• Third-Party Sources — Payment Processors: gd22 may receive limited data from mobile financial service providers (bKash, Nagad, Rocket, Upay) to confirm the status of deposit and withdrawal transactions. This data is used solely for transaction reconciliation.
• Third-Party Sources — Identity Verification Providers: Where gd22 uses a third-party identity verification provider to assist with KYC document checks, that provider may return a verification result (pass/fail) and a confidence score to gd22. The underlying document data remains with the third-party provider in accordance with their own data retention policies.

5 Purposes and Legal Basis for Processing

gd22 processes your personal data only where there is a clear, legitimate purpose for doing so and a valid legal basis for the processing. The table below sets out the primary purposes for which gd22 processes personal data and the corresponding legal basis for each.

6 Sharing Personal Data with Third Parties

gd22 does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. We may share your personal data with the following categories of third parties strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Processors: bKash, Nagad, Rocket, and Upay receive transaction data (mobile number, amount, reference) solely for the purpose of processing your deposit or withdrawal. Each of these providers is bound by its own regulatory obligations under Bangladesh Bank guidelines.
• Identity Verification Providers: Where gd22 uses a third-party KYC service to assist with document verification, that provider receives only the document images and data required to complete the verification check. gd22 selects KYC providers who maintain robust data security practices and confidentiality obligations.
• Game Content Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session data (e.g., game round IDs) for the purpose of game result verification and fairness auditing. These providers do not receive personally identifiable player information such as your name, mobile number, or payment details.
• Analytics Service Providers: gd22 uses privacy-respecting analytics tools to measure platform performance. Any data shared with analytics providers is aggregated and anonymised prior to transmission — individual player identities are not disclosed.
• Legal and Regulatory Authorities: gd22 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, by court order, or in response to a lawful request from a competent authority. gd22 will notify affected players of such disclosures where it is legally permissible to do so.
• Sporting Integrity Bodies: Where gd22 detects or suspects match-fixing or sports fraud activity in connection with betting on its Platform, gd22 may share relevant betting data (anonymised where possible) with the Bangladesh Cricket Board, Bangladesh Football Federation, or relevant international integrity bodies.

7 Cookies and Tracking Technologies

gd22 uses cookies — small text files placed on your device by your browser — and similar first-party tracking technologies to operate the Platform effectively. The table below describes the specific categories of cookies used by gd22.

gd22 does not deploy third-party advertising cookies, behavioural tracking cookies, or retargeting pixels. You can manage or delete cookies at any time through your browser settings. Note that disabling strictly necessary or security cookies will impair your ability to log in and use the Platform. Instructions for managing cookies in common browsers are available via your browser's help documentation.

8 Data Retention

gd22 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply:

• Account and Identity Data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, to satisfy anti-money laundering record-keeping obligations.
• Financial Transaction Data: Retained for a minimum of five (5) years from the date of the transaction, in accordance with financial record-keeping requirements applicable to payment service operations in Bangladesh.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years following account closure. Where an account is closed as a result of a suspected fraud or AML investigation, documents may be retained for a longer period as required by the relevant investigation.
• Betting and Gaming History: Retained for five (5) years from the date of each individual bet or game session, to support dispute resolution and regulatory reporting obligations.
• Support Communications: Live chat and email records are retained for two (2) years from the date of the communication, to support quality assurance and dispute resolution.
• Technical and Analytics Data: Anonymised, aggregated analytics data may be retained indefinitely as it does not constitute personal data. Raw technical logs containing IP addresses are purged after ninety (90) days.
• Marketing Preference Data: Opt-in consent records are retained for the duration of your account and for three (3) years following account closure, to demonstrate compliance with consent requirements.

At the end of the applicable retention period, gd22 will securely delete or anonymise your personal data so that it can no longer be used to identify you. Deletion requests made by players under Section 10 will be honoured subject to the minimum legal retention requirements described above — gd22 cannot delete data that it is legally required to retain.

9 Data Security

gd22 takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and gd22 servers is protected by TLS 1.2 or higher encryption. Connections over plain HTTP are automatically redirected to HTTPS.
• Encryption at Rest: Sensitive personal data — including identity documents, payment account references, and KYC records — is stored using AES-256 encryption on access-controlled servers located in secure data centres.
• Password Security: Player passwords are never stored in plain text. gd22 uses a modern, salted cryptographic hashing algorithm (bcrypt) to store password credentials.
• Access Controls: Access to personal data within gd22's internal systems is restricted to employees and contractors who require it for their specific job function. All internal access is logged and subject to periodic review.
• Two-Factor Authentication: gd22 offers optional two-factor authentication (2FA) for player accounts, adding an additional layer of protection beyond the username and password.
• Penetration Testing: gd22's platform undergoes regular penetration testing by independent security professionals to identify and remediate potential vulnerabilities before they can be exploited.
• Incident Response: gd22 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a risk to the rights and freedoms of affected players, gd22 will notify affected individuals without undue delay and in accordance with applicable legal requirements.

10 Your Data Rights

As a player whose personal data is processed by gd22, you have the following rights in respect of your personal data. To exercise any of these rights, please contact gd22 support via live chat or email as described in Section 13:

• Right of Access: You have the right to request a copy of the personal data that gd22 holds about you, together with information about how that data is used and with whom it is shared. gd22 will provide this information in a structured, commonly used, machine-readable format where technically feasible.
• Right to Rectification: If any personal data gd22 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For some data types (such as contact information), you can update the information directly via your account settings without contacting support.
• Right to Erasure ("Right to Be Forgotten"): You may request that gd22 delete your personal data. This right is subject to gd22's legal obligations — data that gd22 is required by law to retain (such as transaction records and KYC documents under AML regulations) cannot be deleted earlier than the statutory minimum retention period.
• Right to Restrict Processing: You have the right to request that gd22 restrict the processing of your personal data in certain circumstances — for example, where you dispute the accuracy of the data or where you have objected to processing based on legitimate interests and that objection is pending consideration.
• Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format (such as CSV or JSON) and, where technically feasible, to request that it be transferred directly to another data controller.
• Right to Object: Where gd22 processes your personal data on the basis of legitimate interests, you have the right to object to that processing. gd22 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. Withdrawal of consent does not affect your ability to use the Platform.

gd22 will respond to all data rights requests within thirty (30) calendar days of receipt. Where a request is complex or involves a large volume of data, gd22 may extend this period by a further thirty (30) days, in which case you will be notified of the extension and the reason for it. Responding to data rights requests is provided free of charge; however, gd22 reserves the right to charge a reasonable administrative fee for requests that are manifestly unfounded or excessive.

11 Minors and Age Verification

The gd22 Platform is strictly for adults aged 21 years and above. gd22 does not knowingly collect, process, or retain personal data from individuals under the age of 21. This policy reflects both gd22's responsible gaming commitments and the cultural norms of the Bangladesh market.

• All players are required to confirm at the time of registration that they are at least 21 years of age.
• gd22 reserves the right to request government-issued age verification documents from any player at any time. If a player cannot provide satisfactory proof of age, their account will be suspended until verification is complete or permanently closed if the player is confirmed to be under 21.
• If gd22 becomes aware — through age verification, a third-party report, or any other means — that a player is under 21, gd22 will immediately suspend the account, void any pending bets, and return Real Money Funds to the payment method used for deposit after deduc ting any bonuses that were awarded to the account.
• Parents and guardians in Bangladesh who believe a minor may have accessed gd22 are encouraged to contact our support team immediately via live chat. gd22 will investigate all such reports with priority.
• gd22 recommends that households with minors make use of freely available parental control software to restrict access to online gambling platforms. Parental control tools are available from major browser vendors and third-party providers.

12 Changes to This Privacy Policy

gd22 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, data protection best practices, or the features and services offered by the Platform. When material changes are made to this Policy, gd22 will:

• Update the "Effective Date" displayed at the top of this page and increment the version number;
• Send a notification to all registered players via the email address associated with their account at least fourteen (14) calendar days before the amended Policy takes effect;
• Display a prominent notice on the Platform for a minimum of fourteen (14) calendar days following the update.

Your continued use of the Platform after the effective date of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should close your account and cease using the Platform before the amended Policy takes effect. For non-material changes — such as typographical corrections, clarifications, or updates to contact details — gd22 may update this Policy without prior notice, though the effective date will always reflect the date of the most recent update.

gd22 encourages all players to review this Privacy Policy periodically, particularly before making deposits or engaging in high-value betting activity. The most current version of this Policy is always available at https://gd22.io/privacy-policy.

13 Contact and Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which gd22 handles your personal data, please contact our support team using the details below. All privacy-related communications should clearly state "Privacy Enquiry" in the subject line or opening message to ensure they are routed to the appropriate team member.

• Live Chat: Available 24 hours a day, 7 days a week via the gd22 Platform. Average response time is under one minute. Language of support: English. Time zone: Bangladesh Standard Time (UTC+6).
• Email (plain text — not a link): [email protected]
• Response Time: gd22 aims to acknowledge all written privacy enquiries within 48 hours and to provide a substantive response within 30 calendar days of receipt.

gd22 takes all privacy complaints seriously and will investigate each complaint thoroughly and impartially. Where a complaint cannot be resolved to your satisfaction through direct engagement with gd22's support team, you retain the right to escalate the matter to the relevant data protection authority or seek independent legal advice.