gvaji Privacy Policy
At gvaji, protecting the personal data of our players in Bangladesh is a responsibility we take seriously. This Privacy Policy explains exactly what information we collect when you use our platform, how we use and store it, who we may share it with, and how you can exercise your rights over your own data. We recommend reading it alongside our Terms & Conditions.
Our Privacy Commitments to You
Every piece of data you transmit to gvaji — including login credentials, payment details, and personal identification documents — is protected by industry-standard SSL/TLS encryption both in transit and at rest on our servers.
gvaji collects only the personal data that is strictly necessary to operate a safe, compliant, and enjoyable betting platform. We do not collect data beyond what is required to verify your identity, process payments, and deliver our services.
gvaji does not sell, rent, or trade your personal data to any third party for their own marketing purposes. Your information is shared only where required to deliver the services you have requested or where legally obligated to do so.
You have the right to access, correct, and request deletion of your personal data held by gvaji. We respond to all verified data subject requests within 30 days of receipt. Submit your request to [email protected] at any time.
We use cookies and similar tracking technologies solely to improve your experience on the gvaji platform — including remembering your session, measuring site performance, and personalising game recommendations. No third-party advertising cookies are set without disclosure.
We do not store your data indefinitely. gvaji maintains clear data retention schedules aligned with legal and regulatory obligations. Account data is retained for a defined period after closure; after that period expires, it is securely deleted or anonymised.
1 Information We Collect
gvaji collects personal data from you directly when you interact with our platform, and in some cases automatically as you browse or play. The categories of personal data we collect are described below.
Registration and Identity DataWhen you create a gvaji account, we collect the following information to establish your identity and ensure compliance with our 18+ age restriction policy:
- Full legal name as it appears on your government-issued identification document.
- Date of birth, to verify that you meet the minimum age requirement of 18 years.
- Residential address, including district, city (Dhaka, Chittagong, Sylhet, or other), and postal code.
- Email address, used for account communications and support correspondence.
- Mobile phone number, used for account security verification and bKash / Nagad payment processing where applicable.
- Username and encrypted password — we store only a one-way hash of your password; the plaintext password is never stored or accessible to staff.
To comply with our Know Your Customer (KYC) obligations and to protect the integrity of the platform, gvaji may request copies of the following documents during the account verification process:
- National Identity Card (NID) — front and back
- Bangladesh Passport — photo page
- Driving Licence — front and back
- Proof of address — recent utility bill, bank statement, or official correspondence (dated within 90 days)
- Proof of payment method ownership — screenshot of bKash or Nagad wallet screen showing your registered mobile number, or bank statement header
To process deposits and withdrawals, gvaji records the following financial information:
- Payment method type (bKash, Nagad, Rocket, Upay, bank transfer, or card)
- Mobile wallet number or bank account reference (stored as a masked or tokenised reference — full account numbers are not stored on gvaji servers)
- Transaction amounts, timestamps, and transaction reference numbers
- Deposit and withdrawal history associated with your account
We record data relating to your activity on the platform, including:
- Game sessions played, wager amounts, game outcomes, and net win/loss records
- Sports betting markets accessed, selections made, and bet outcomes
- Bonus offers claimed and wagering progress
- Responsible gaming tool settings (deposit limits, session time limits, self-exclusion status)
When you access the gvaji platform, our servers automatically collect the following technical data:
- IP address and approximate geographic location (country/city level)
- Device type, operating system, and browser version
- Pages visited, time spent on each page, and navigation path through the site
- Session start and end times
- Referring URL (the page you visited immediately before arriving at gvaji.net)
If you contact the gvaji support team by email or live chat, we retain records of those communications — including the content of messages, timestamps, and the support agent who handled your query — for quality assurance, training, and dispute resolution purposes.
gvaji adheres to the principle of data minimisation. We only ask for information that is directly relevant to providing our services. If a data field is optional during registration, it is clearly labelled as such. You will never be required to share data that exceeds what is necessary for account operation.
2 How We Use Your Data
gvaji uses the personal data we collect for the following specific and legitimate purposes. We do not use your data in any way that is incompatible with the purposes described in this section.
| Purpose | Data Categories Used | Legal Basis |
|---|---|---|
| Account creation and verification | Registration data, ID documents, mobile number | Contractual necessity |
| Processing deposits and withdrawals | Financial data, mobile wallet number, bank reference | Contractual necessity |
| Age and identity verification (KYC) | Date of birth, ID documents, proof of address | Legal obligation |
| Fraud prevention and AML monitoring | Transaction data, IP address, device data, gaming activity | Legitimate interest / Legal obligation |
| Delivering customer support | Communications data, account data, transaction history | Contractual necessity |
| Personalising your gaming experience | Gaming activity data, session data, device data | Legitimate interest / Consent |
| Responsible gaming monitoring | Gaming activity, deposit patterns, session duration, self-exclusion status | Legal obligation / Legitimate interest |
| Sending promotional communications | Email address, name, gaming preferences | Consent (opt-in only) |
| Platform security and technical maintenance | IP address, device data, usage data, session data | Legitimate interest |
| Compliance with legal requests | Any relevant data as requested by competent authorities | Legal obligation |
If you have opted in to receive promotional emails or SMS notifications from gvaji — for example, to receive information about seasonal bonus offers during BPL, Eid promotions, or Pohela Boishakh deposit matches — we will use your email address and name for that purpose. You may withdraw your consent to receive marketing communications at any time by clicking the unsubscribe link in any email, or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to the withdrawal.
Automated Decision-Makinggvaji uses automated systems to monitor player accounts for indicators of problem gambling, fraudulent activity, and money laundering patterns. These systems may automatically flag an account for review or apply a temporary restriction where a pattern of concern is identified. Where a significant decision affecting your account (such as a suspension) is made partly or wholly by an automated system, you have the right to request human review of that decision by contacting [email protected].
3 Sharing Your Information
gvaji does not sell your personal data. We share your information only in the specific circumstances described below, and only to the minimum extent necessary for each purpose.
Payment Service ProvidersTo process deposits and withdrawals, gvaji shares relevant transaction data with the payment service providers you select — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, and card scheme processors (Visa, Mastercard). Each of these providers operates under its own privacy policy and is bound by data processing agreements with gvaji that restrict the use of your data to transaction processing only.
Game Software ProvidersWhen you play games on the gvaji platform that are supplied by third-party providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — your game session data (player ID, wager amounts, game outcomes) is processed by those providers' systems in real time. This is necessary to deliver the game experience. These providers act as data processors on behalf of gvaji and are contractually prohibited from using your data for their own independent purposes.
Identity Verification Servicesgvaji may use third-party identity verification services to assist with KYC checks. Where we do so, your identity documents and personal details will be shared with the verification provider solely for the purpose of confirming your identity and age. The provider is bound by a data processing agreement and strict confidentiality obligations.
Legal and Regulatory Disclosuresgvaji may be required to disclose your personal data to law enforcement agencies, regulatory authorities, or courts in response to a lawful request. We will comply with such requests to the extent legally required, and will notify you of any such disclosure where we are legally permitted to do so.
Corporate TransfersIn the event of a merger, acquisition, or sale of substantially all of the assets of gvaji, your personal data may be transferred to the successor entity as part of the transaction. We will notify you of any such transfer and of any material changes to the way your data is processed that may result from it.
Every third party that processes personal data on behalf of gvaji is required to sign a formal Data Processing Agreement (DPA). These agreements bind the processor to use your data only for the specific purpose authorised, maintain appropriate security standards, and return or destroy data once the processing purpose is fulfilled.
Game providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi.
Each partner is vetted for data security practices before integration with the gvaji platform.
5 Data Retention
gvaji retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. The retention periods below reflect our standard data management schedule.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of account + 5 years after closure | AML and KYC regulatory requirements |
| Identity verification documents | Duration of account + 5 years after closure | KYC compliance, fraud investigation |
| Financial transaction records | Duration of account + 7 years after closure | Financial record-keeping obligations |
| Gaming and betting activity logs | Duration of account + 3 years after closure | Dispute resolution, responsible gaming audit |
| Customer support correspondence | 3 years from the date of last interaction | Quality assurance, dispute evidence |
| Analytics and usage data | 12 months (aggregated/anonymised thereafter) | Platform improvement |
| Marketing consent records | Until consent is withdrawn + 2 years | Evidence of lawful marketing basis |
Once the applicable retention period has expired, gvaji will securely delete or irreversibly anonymise your personal data so that it can no longer be linked back to you as an individual. Anonymised data — which cannot identify any specific person — may be retained indefinitely for statistical and analytical purposes.
6 Security Measures
gvaji takes the security of your personal data seriously. We implement a layered set of technical and organisational measures designed to protect your information from unauthorised access, accidental loss, destruction, or disclosure.
Technical Security Controls- SSL/TLS Encryption: All data transmitted between your browser and the gvaji server is encrypted using TLS 1.2 or higher. The gvaji.net domain enforces HTTPS across all pages and subdomains.
- Password Hashing: Account passwords are stored as salted one-way cryptographic hashes. The plaintext password is never stored and cannot be retrieved even by gvaji staff.
- Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their accounts for an additional layer of login security. 2FA is available via time-based one-time password (TOTP) apps.
- Tokenisation of Payment Data: Mobile wallet references and bank account identifiers are stored in tokenised form. Raw account numbers are not stored on gvaji systems after the initial transaction is processed.
- Intrusion Detection: Our infrastructure is monitored continuously by automated intrusion detection and anomaly-alerting systems. Suspicious activity triggers an immediate security review.
- Access Control: Access to personal data within gvaji is restricted on a strict need-to-know basis. Staff access to player data is role-based, logged, and subject to regular audit.
- All staff who handle personal data receive data protection training as part of their onboarding and annually thereafter.
- gvaji conducts periodic internal security reviews and external penetration testing to identify and remediate vulnerabilities.
- Third-party data processors are assessed for security compliance before they are granted access to any personal data.
- A documented incident response procedure is in place. In the event of a data breach that is likely to affect your rights and freedoms, gvaji will notify affected players without undue delay.
While gvaji implements robust security measures on our end, you also have a role to play in protecting your account. You are responsible for choosing a strong, unique password for your gvaji account, keeping your login credentials confidential, logging out of your account when using a shared device, and notifying gvaji immediately at [email protected] if you suspect unauthorised access to your account.
gvaji casino games use certified random number generation (RNG) technology. Game outcomes are independently tested to ensure statistical fairness. Players can verify that they are receiving a genuinely random gaming experience at all times.
7 Your Privacy Rights
As a player on the gvaji platform, you have the following rights with respect to your personal data. These rights may be subject to limitations in certain circumstances — for example, where retention is required by law or where fulfilling a request would adversely affect the rights of another person. gvaji will respond to all valid requests within 30 days of receipt.
You have the right to request a copy of all personal data that gvaji holds about you. We will provide this in a structured, commonly used, and machine-readable format (JSON or CSV) upon verified request.
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update basic account details (such as your address or email) directly through your account settings, or contact [email protected] for corrections to identity documents or other records.
You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the data has been unlawfully processed. Note that this right is subject to our legal obligation to retain certain records (such as transaction history) for the periods described in Section 5.
You may request that gvaji restrict the processing of your personal data in certain circumstances — for example, while a rectification request is under review, or where you have objected to processing and we are assessing whether our legitimate interests override your objection.
Where processing is based on your consent or a contract, and is carried out by automated means, you have the right to receive your personal data in a portable format and, where technically feasible, to have it transmitted directly to another controller.
You have the right to object at any time to the processing of your personal data where that processing is based on gvaji's legitimate interests. You also have an unconditional right to object to the use of your data for direct marketing purposes, including profiling for marketing purposes.
Where processing is based on your consent — such as for marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, use the unsubscribe link in any email or contact [email protected].
Where a significant decision affecting your account is made solely by automated means — such as an automated account suspension triggered by our fraud detection system — you have the right to request that the decision be reviewed by a human member of the gvaji compliance or security team.
8 Contact and Data Requests
If you have any questions, concerns, or requests relating to this Privacy Policy or to the way gvaji processes your personal data, you are encouraged to contact us. gvaji is committed to resolving all privacy-related enquiries promptly and transparently.
Privacy Contact DetailsAll privacy-related correspondence should be directed to the gvaji privacy team at the email address below. Please do not send sensitive personal documents (such as copies of your NID or passport) in an unencrypted email. Our support team will provide a secure upload method upon request.
Email (plain text — not a link):
[email protected]Subject line to use:
"Privacy Policy Enquiry" or "Data Subject Request"Response time: within 30 days (Bangladesh Standard Time, UTC+6)
gvaji reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. When we make material changes to this policy, we will notify active account holders by email to their registered address and display a prominent notice on the gvaji.net website for at least 14 days before the updated policy takes effect.
The effective date at the top of this policy will always reflect the date of the most recent revision. We encourage you to review this policy periodically so that you remain informed about how we protect your data. Continued use of the gvaji platform after any update constitutes your acceptance of the revised Privacy Policy.
Children and MinorsThe gvaji platform is strictly for adults aged 18 years and above. We do not knowingly collect personal data from any individual under the age of 18. If we become aware that a minor has registered an account or provided personal data, we will immediately suspend the account, delete the associated data, and take appropriate steps to prevent future access by that individual. If you believe a minor has registered on the gvaji platform, please notify us immediately at [email protected].
Governing LawThis Privacy Policy and all matters relating to the processing of your personal data by gvaji are governed by the laws applicable to the operation of the gvaji platform. Any dispute arising in connection with this policy that cannot be resolved through direct communication with the gvaji privacy team will be subject to the dispute resolution provisions set out in the gvaji Terms & Conditions.
This Privacy Policy should be read alongside our other legal documents for a complete understanding of your rights and obligations as a gvaji player.
Ready to Experience gvaji?
Now that you are familiar with how we protect your data, explore everything gvaji has to offer — from cricket betting and slots to live casino games, all in BDT with local payment methods.