gajee Privacy Policy — Your Data, Your Rights, Our Obligations

1 Introduction

This Privacy Policy ("Policy") is published by gajee ("we", "us", "our", "the Platform") and applies to all personal data collected from individuals ("you", "your", "User") who access or use the gajee website at https://gajee.io and any associated services, mobile interfaces, or applications (collectively, "the Platform").

gajee is committed to handling your personal data responsibly, transparently, and in a manner consistent with internationally recognised data protection principles. This Policy describes the categories of personal data we collect, the purposes for which that data is processed, the legal bases on which we rely, the parties with whom data may be shared, the security measures we employ, and the rights available to you as a data subject.

By accessing or using the gajee Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any aspect of this Policy, you should discontinue use of the Platform and contact [email protected] to request deletion of any data we may hold about you.

This Policy should be read in conjunction with the gajee Terms & Conditions, which are available at https://gajee.io/terms-conditions and are incorporated by reference into this Policy. In the event of a conflict between this Policy and the Terms & Conditions on a privacy-specific matter, this Policy shall prevail.

2 Data Controller

For the purposes of this Policy, gajee acts as the data controller in respect of all personal data collected through the Platform. As data controller, gajee determines the purposes and means by which your personal data is processed.

All data protection enquiries, rights requests, and complaints relating to gajee's handling of personal data should be directed to our designated data protection contact at the following address:

• Email: [email protected]
• Subject line: "Data Protection Enquiry" or "Privacy Rights Request"
• Response target: Within 5 business days for general enquiries; within 30 calendar days for formal rights requests.

gajee is committed to acknowledging all privacy-related communications promptly and to resolving data protection matters in good faith and without undue delay.

3 Categories of Personal Data We Collect

The personal data collected by gajee varies depending on your level of interaction with the Platform. The following table sets out the principal categories of data collected and the context in which each category arises:

4 How We Collect Your Personal Data

gajee collects personal data through the following channels and mechanisms:

4.1 Direct Collection

You provide data directly to gajee when you complete the account registration form, submit identity verification documents, make a deposit or withdrawal request, contact customer support, or update your account profile. All such data is provided voluntarily, though certain categories are mandatory for the delivery of specific services (for example, identity documents are required to process withdrawals).

4.2 Automated Collection

When you access the gajee Platform, certain technical and usage data is collected automatically through cookies, web server logs, and similar tracking technologies. This includes your IP address, browser fingerprint, device identifiers, and session activity data. Automated collection occurs upon your first visit to the Platform and continues throughout each subsequent session. Please refer to Section 8 of this Policy for further information on cookies and tracking technologies.

4.3 Third-Party Sources

In certain circumstances, gajee may receive personal data about you from third-party sources, including:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and USDT network providers may share transaction confirmation data with gajee to verify successful payment completion.
• Identity verification providers: Third-party KYC service providers may supply enhanced identity verification results, including document authenticity checks and watchlist screening outcomes.
• Fraud prevention services: Risk management and fraud detection partners may provide risk scores or flags associated with specific device fingerprints, IP addresses, or payment methods.
• Responsible gaming databases: Where applicable, self-exclusion registers or responsible gaming support networks may share information relevant to a user's exclusion status.

5 Legal Basis for Processing

gajee processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing is necessary for the performance of the contract between you and gajee — specifically, the Terms & Conditions you accepted at registration. This covers account creation, deposit and withdrawal processing, game delivery, bonus administration, and customer support.
• Legal obligation: Processing is required to comply with applicable legal obligations, including anti-money laundering regulations, identity verification requirements, tax reporting obligations, and data retention mandates imposed by law.
• Legitimate interests: Processing is necessary for the legitimate interests of gajee or a third party, provided those interests are not overridden by your fundamental rights and freedoms. Legitimate interests pursued by gajee include fraud prevention, platform security, responsible gaming monitoring, internal analytics, and business improvement activities.
• Consent: Where processing is not otherwise justified by the above bases — in particular, for the sending of marketing communications by email or SMS — gajee relies on your explicit, freely given, and revocable consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 How We Use Your Personal Data

gajee uses the personal data we collect for the following defined purposes. We do not use personal data for any purpose that is incompatible with the purposes described in this Policy without first providing you with notice and, where required, obtaining your consent.

6.1 Account Management

Identity data, contact data, and document data are used to create and maintain your gajee account, to verify your identity and age eligibility (21+), to reset your password, and to communicate account-related notifications such as deposit confirmations, withdrawal approvals, and security alerts.

6.2 Payment Processing

Financial data and transaction data are used to process deposits made via bKash, Nagad, Rocket, Upay, USDT, Visa, and Mastercard, and to fulfil withdrawal requests to your verified payment account. Payment data is also used to detect and prevent fraudulent transactions and to comply with anti-money laundering obligations.

6.3 Regulatory Compliance and KYC

Identity data, document data, and financial data are processed to satisfy applicable Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations. This includes conducting identity checks, screening against sanctions and watchlists, maintaining records of verification outcomes, and reporting suspicious transactions as required by law.

6.4 Platform Security and Fraud Prevention

Technical data and usage data are processed to detect and investigate suspicious activity, prevent unauthorised account access, identify duplicate accounts, flag potential bonus abuse, and protect the integrity of the gajee platform for all users.

6.5 Responsible Gaming

Responsible gaming data, transaction data, and usage data are processed to monitor gambling behaviour for signs of problematic play, to enforce deposit limits and session restrictions set by users, to facilitate self-exclusion requests, and to conduct welfare check-ins where gajee has reasonable concern about a user's gambling behaviour.

6.6 Customer Support

Communications data, identity data, and account data are processed to respond to your support enquiries, to resolve disputes or complaints, and to maintain records of interactions for quality assurance and training purposes.

6.7 Analytics and Platform Improvement

Usage data and technical data are processed in aggregated or anonymised form to understand how users navigate the Platform, which features are most popular, where users encounter friction, and how the overall platform experience can be improved. No individual user is identified in these analytics reports.

6.8 Marketing Communications

Where you have provided explicit consent, contact data and marketing preference data are used to send you promotional emails or SMS messages about new games, upcoming tournaments, seasonal promotions (such as BPL cricket betting offers or Eid special bonuses), and other gajee services that we believe may be of interest to you. You may opt out of marketing communications at any time. See Section 12 for details.

7 Data Sharing and Third-Party Disclosure

gajee does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your personal data with the following categories of third parties, strictly for the purposes described in this Policy:

7.1 Payment Service Providers

Financial data and identity data may be shared with payment processors — including bKash, Nagad, Rocket, Upay, USDT network providers, Visa, and Mastercard — solely to facilitate deposit and withdrawal transactions you have initiated. These providers operate under their own privacy policies and are independently responsible for the data they process in their capacity as payment principals.

7.2 Identity Verification and KYC Partners

Document data and identity data may be shared with third-party identity verification service providers to conduct electronic identity checks, document authentication, liveness detection, and watchlist screening. All such providers are contractually bound to process your data only for the purpose of providing verification services to gajee.

7.3 Fraud Prevention and Security Services

Technical data and transaction data may be shared with fraud detection platforms to calculate risk scores, flag suspicious activity, and prevent financial crime. These services process data only in accordance with instructions from gajee and are not permitted to use the data for their own commercial purposes.

7.4 Legal and Regulatory Authorities

gajee may be required to disclose personal data to law enforcement agencies, financial intelligence units, courts, or regulatory bodies in response to a lawful request, court order, or legal obligation. In such circumstances, gajee will disclose only the minimum data necessary to satisfy the legal requirement and will, where legally permitted, notify the affected user that a disclosure has been made.

7.5 Technology Infrastructure Providers

Technical data and usage data may be accessible to gajee's hosting providers, content delivery network operators, and cloud infrastructure partners in the ordinary course of providing the platform infrastructure. All such providers are subject to data processing agreements that restrict their use of personal data to the provision of infrastructure services.

8 Cookies and Tracking Technologies

8.1 What Are Cookies

Cookies are small text files that are placed on your device by a website when you visit it. They allow the website to remember information about your visit — such as your login session and preferences — and to collect anonymised data about how the site is used. gajee uses cookies and similar technologies including local storage and session tokens on the Platform.

8.2 Categories of Cookies Used by gajee

• Strictly necessary cookies: These cookies are essential for the Platform to function correctly. They maintain your login session, remember items in your account, and ensure security features operate as intended. These cookies cannot be disabled without significantly impairing your ability to use the Platform.
• Functional cookies: These cookies remember your preferences — such as your preferred language, display settings, and responsible gaming configuration — so that you do not need to re-enter them on each visit.
• Analytics cookies: These cookies collect anonymised data about how visitors use the Platform — such as which pages are visited most frequently and how long users spend on each section — to help gajee improve the overall user experience. No personally identifiable information is stored in analytics cookies.

8.3 Cookie Management

You may control the use of non-essential cookies through your browser settings. Most browsers allow you to block or delete cookies; however, disabling strictly necessary cookies may prevent you from logging in or using certain features of the Platform. Instructions for managing cookies in major browsers are available through the help documentation of your respective browser provider.

9 Data Security

gajee implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• TLS 1.3 encryption for all data transmitted between your device and gajee servers.
• AES-256 encryption for sensitive data stored at rest in gajee databases, including financial data and identity document records.
• Role-based access controls that restrict internal access to personal data to only those employees and systems that require it to fulfil their specific operational functions.
• Multi-factor authentication for all internal administrative access to systems containing personal data.
• Regular penetration testing and security audits conducted by independent third-party security professionals to identify and remediate vulnerabilities.
• Intrusion detection and prevention systems that monitor platform traffic for anomalous patterns indicative of attempted data breaches or cyberattacks.
• Secure data disposal procedures ensuring that personal data that has reached the end of its retention period is irreversibly deleted or anonymised.

Despite the above measures, no internet-based data transmission or storage system can be guaranteed to be 100% secure. In the event of a personal data breach that poses a risk to your rights and freedoms, gajee will notify affected users without undue delay and will take immediate remedial action to contain the breach and prevent recurrence.

10 Data Retention

gajee retains personal data for the periods necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to the principal categories of data processed by gajee:

Upon expiry of the applicable retention period, personal data will be securely and irreversibly deleted from gajee's systems, or anonymised such that it can no longer be linked to an identifiable individual. Where data is anonymised rather than deleted, the resulting anonymised dataset may be retained indefinitely for statistical and analytical purposes.

11 Your Data Protection Rights

As a data subject, you are entitled to exercise the following rights in respect of the personal data held about you by gajee. To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy Rights Request", providing your full name, registered email address, and a description of the right you wish to exercise.

• Right of access: You have the right to request a copy of the personal data gajee holds about you, together with information about the purposes for which it is processed, the categories of data held, the recipients to whom it has been disclosed, and the retention periods that apply.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data held by gajee. You may correct certain account information directly through the account settings section of the Platform without contacting support.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to gajee's legal retention obligations and may not apply to data we are required to retain by law.
• Right to restriction of processing: You have the right to request that gajee restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is contested, or while an objection to processing is assessed.
• Right to data portability: You have the right to receive a copy of the personal data you provided to gajee in a structured, commonly used, machine-readable format, and to transmit that data to another data controller, where the processing is based on consent or contractual necessity and is carried out by automated means.
• Right to object: You have the right to object to processing of your personal data carried out on the basis of legitimate interests, including profiling for responsible gaming monitoring purposes. gajee will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

gajee will not charge a fee for handling rights requests unless they are manifestly unf ounded or excessive, in particular because of their repetitive character. In such circumstances, gajee may charge a reasonable fee or refuse to act on the request, and will inform you accordingly.

12 Marketing Communications

gajee may send you promotional communications by email or SMS where you have provided explicit opt-in consent at registration or through your account settings. Marketing communications from gajee may include information about new game releases, upcoming live cricket betting events such as BPL and IPL fixtures, seasonal promotions tied to events like Eid or Pohela Boishakh, deposit match bonuses, and free spin offers.

You may opt out of receiving marketing communications at any time by:

• Clicking the "unsubscribe" link included in every marketing email sent by gajee;
• Updating your communication preferences in the notifications section of your gajee account settings; or
• Contacting [email protected] with the subject line "Marketing Opt-Out" and your registered email address.

Opting out of marketing communications will not affect your ability to use the Platform or receive essential account communications such as deposit confirmations, withdrawal notifications, identity verification requests, and security alerts. Essential account communications are not marketing in nature and are sent on the basis of contractual necessity rather than consent.

gajee does not share your contact data with third-party advertisers for the purpose of sending you marketing communications on their behalf. All marketing messages sent to gajee users originate exclusively from gajee and relate solely to the gajee Platform and its services.

13 Children and Minors

The gajee Platform is strictly intended for adults aged 21 years and above. gajee does not knowingly collect, store, or process personal data belonging to individuals under the age of 21. Age verification is a mandatory step in the account registration process, and gajee reserves the right to request documentary proof of age at any stage of the account lifecycle.

Parents and guardians who believe that a minor in their care may have registered on the gajee Platform are urged to contact [email protected] immediately. gajee will investigate such reports with priority and will take immediate account action upon verification of an under-age registration. We also strongly encourage the use of parental control software and internet filtering tools to prevent minors from accessing gambling websites.

14 Third-Party Links and Embedded Content

The gajee Platform does not contain links to external third-party websites or embed third-party content that would result in your personal data being collected or processed by parties outside the scope of this Policy. The navigational structure of the gajee Platform is limited to internal pages as described in the site's menu structure.

In the event that any third-party integration is introduced to the Platform in future — such as a live streaming service for cricket events or a third-party responsible gaming support tool — this Policy will be updated accordingly, and you will be notified of the change as described in Section 15. gajee accepts no responsibility for the privacy practices of third-party websites or services that you may access independently outside the gajee Platform.

15 Updates to This Privacy Policy

gajee reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or operational changes to the Platform. The "Last Updated" date at the top of this Policy will be revised whenever a material change is made.

Where a change is material — meaning it significantly affects how your personal data is processed or your rights as a data subject — gajee will notify registered users by email to the address on file and will display a prominent notice on the Platform for a period of not less than 30 days following the update. Your continued use of the Platform after the effective date of a revised Policy constitutes your acknowledgement of the updated terms.

We encourage you to review this Policy periodically to remain informed about how gajee protects your personal data. The most current version of this Policy is always available at https://gajee.io/privacy-policy.

16 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to gajee's processing of your personal data, please contact our data protection team using the details below. We are committed to responding to all privacy-related enquiries in a timely, transparent, and constructive manner.

• Email: [email protected]
• Subject line for rights requests: "Privacy Rights Request"
• Subject line for general queries: "Privacy Policy Enquiry"
• Response target: 5 business days for general enquiries; 30 calendar days for formal rights requests
• Business hours: 24/7 support available; formal rights requests processed on Bangladesh Standard Time (BST, UTC+6) business days