gaya9 Privacy Policy — How We Handle Your Personal Data

1 Introduction

This Privacy Policy ("Policy") describes how gaya9 ("we", "us", "our") — the operator of the website located at https://gaya9.ws — collects, uses, stores, and discloses personal information relating to players and visitors ("you", "your") who access or use the gaya9 platform, including its games, sports betting markets, live casino, payment services, and associated features.

gaya9 is committed to protecting your personal data and handling it responsibly. We operate this platform primarily to serve players located in Bangladesh, and we apply data protection principles consistent with best-practice standards to all personal data we process.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which form part of the overall agreement governing your use of gaya9. By registering an account or continuing to use the gaya9 platform, you acknowledge that you have read and understood this Privacy Policy.

2 Data We Collect

gaya9 collects personal data in the following categories, depending on how you interact with the platform:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health records, or biometric data unless specifically required by a regulatory authority and disclosed to you at the time of collection.

3 How We Use Your Data

gaya9 uses the personal data we collect for the following purposes:

• Account management: To create, verify, maintain, and secure your gaya9 account, including processing your registration and KYC verification.
• Service delivery: To enable you to access games, place bets, participate in live casino events, and use all platform features you have registered to access.
• Payment processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and partner banks; to verify payment method ownership; and to maintain accurate financial records.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, multi-accounting, money laundering, and other prohibited conduct. This includes automated risk-scoring of account behaviour.
• Responsible gaming compliance: To monitor for indicators of problem gambling, enforce self-exclusion requests, apply deposit limits, and comply with our responsible gaming obligations.
• Customer support: To respond to your queries, resolve disputes, and provide technical assistance through live chat, email, and WhatsApp.
• Legal and regulatory compliance: To meet record-keeping, identity verification, anti-money-laundering (AML), and other legal obligations applicable to our operations.
• Platform improvement: To analyse aggregated usage data and improve the performance, usability, and content of the gaya9 platform. This analysis is conducted on anonymised or pseudonymised data sets.
• Promotional communications: To send you information about bonuses, promotions, and platform updates — only where you have opted in to receive such communications. You may unsubscribe at any time.

gaya9 does not use your personal data for automated decision-making that produces significant legal effects without a human review step, except where automated transaction screening is required by anti-fraud or AML obligations.

4 Legal Basis for Processing

gaya9 processes your personal data on one or more of the following lawful bases:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you agreed to when registering — including account creation, service delivery, and payment processing.
• Legal obligation: Processing necessary to comply with applicable laws, including identity verification, financial record-keeping, and anti-money-laundering requirements.
• Legitimate interests: Processing carried out to protect the platform's security, prevent fraud, improve our services, and conduct internal analytics — provided these interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and non-essential cookies, where we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5 Data Sharing and Disclosure

gaya9 does not sell, rent, or trade your personal data. We may share your information only in the following circumstances:

• Payment service providers: We share the minimum necessary financial data with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank to process deposits and withdrawals. These providers operate under their own privacy policies and are contractually obligated to protect your data.
• Game content providers: Limited technical data (session tokens, game identifiers) may be shared with providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi to deliver game content. No personally identifiable information beyond what is technically required is shared.
• Fraud prevention and KYC services: Identity data and financial data may be shared with third-party KYC verification and fraud detection service providers who are bound by strict confidentiality agreements.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required by applicable law, court order, or regulatory mandate.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of our assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

6 Cookies and Tracking Technologies

gaya9 uses cookies and similar technologies (including local storage, session storage, and pixel tags) to operate and improve the platform. The cookies we use fall into the following categories:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies, load-balancing tokens, and security tokens. These cannot be disabled without impairing your ability to use the platform.
• Functional cookies: Used to remember your preferences such as language settings, display options, and last-visited game categories. These improve your experience but are not essential.
• Analytics cookies: Used to collect anonymised information about how visitors interact with the gaya9 platform — including pages visited, time on page, and navigation paths. This data helps us identify areas for improvement. No individual is identified from analytics data.
• Security and fraud-detection cookies: Used to identify unusual or suspicious access patterns and protect the integrity of your account session.

gaya9 does not use third-party advertising cookies or cross-site tracking pixels. You may manage your cookie preferences through your browser settings. Blocking strictly necessary cookies may prevent you from logging in or using key platform features.

7 Data Retention

gaya9 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active account data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with financial record-keeping obligations.
• KYC verification documents: Retained for a minimum of five (5) years following account closure or the completion of the most recent transaction, whichever is later.
• Transaction records: Retained for a minimum of five (5) years following the transaction date.
• Support communications: Retained for three (3) years from the date of last communication, unless related to an ongoing dispute or legal matter.
• Technical and usage logs: Retained for up to twelve (12) months from the date of collection, after which they are anonymised or deleted.
• Marketing consent records: Retained for three (3) years from the date of last interaction or until consent is withdrawn, whichever is earlier.

When retention periods expire, personal data is securely deleted or anonymised so that it can no longer be linked to any individual. Data that has been anonymised may be retained indefinitely for statistical and analytical purposes.

8 Data Security

gaya9 implements a layered security architecture to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our security measures include:

• Transport encryption: All data transmitted between your device and gaya9 servers is encrypted using 256-bit TLS (Transport Layer Security). Our SSL certificate is maintained and renewed regularly.
• Access controls: Access to personal data within the gaya9 organisation is restricted on a strict need-to-know basis. Staff members are granted access only to the data categories required to perform their specific role.
• Password security: Account passwords are stored using one-way cryptographic hashing. gaya9 staff cannot view or retrieve your plaintext password at any time.
• Penetration testing: The gaya9 platform undergoes periodic security assessments to identify and address vulnerabilities before they can be exploited.
• Incident response: In the event of a data breach that affects your personal information, gaya9 will notify affected players within a reasonable period and take immediate remedial action to contain the breach.

While gaya9 takes all reasonable technical and organisational measures to protect your data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for notifying us promptly if you suspect unauthorised access to your account.

9 Your Rights

As a gaya9 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our support team at support@gaya9.ws:

• Right of access: You may request a copy of the personal data gaya9 holds about you. We will provide this within a reasonable timeframe (typically within 30 days of a verified request).
• Right to rectification: You may request correction of any personal data that is inaccurate or incomplete. For basic account details, you may update these directly via your account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected and where no legal retention obligation applies. Note that we are legally required to retain financial and KYC records for the periods stated in Section 7.
• Right to restriction: You may request that we restrict processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to data portability: You may request that we provide your personal data in a commonly used, machine-readable format so that it can be transferred to another service provider where technically feasible.
• Right to object: You may object to processing carried out on the basis of legitimate interests, including any profiling related to responsible gaming monitoring. We will cease such processing unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

10 Children and Minors

gaya9 is strictly an adult platform. We do not knowingly collect, process, or store personal data from individuals under the age of 21. Our registration process includes date-of-birth verification and KYC checks specifically to prevent underage access.

If gaya9 becomes aware that personal data has been collected from an individual under the age of 21, we will immediately suspend the associated account, delete all personal data relating to that individual (subject to any mandatory legal retention requirements), and, where appropriate, refer the matter to relevant authorities.

If you believe that a minor has registered on the gaya9 platform, please contact us immediately at support@gaya9.ws so that we can take prompt action.

11 Third-Party Links

The gaya9 platform may contain references to game providers and payment partners. While gaya9 takes care to partner with reputable organisations, we are not responsible for the privacy practices of third-party services. Each third party operates under its own privacy policy, which we encourage you to review before engaging with their services independently of the gaya9 platform.

gaya9 does not embed third-party social media tracking pixels, advertising networks, or affiliate tracking scripts that could transmit your personal data to external parties without your knowledge.

12 Changes to This Policy

gaya9 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or platform features. When material changes are made, we will notify registered players via email or an in-platform notification at least seven (7) days before the revised Policy takes effect.

The "Last updated" date at the top of this document reflects the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the gaya9 platform after the effective date of any amendment constitutes your acceptance of the updated Policy.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way gaya9 handles your personal data, please contact our Data Support team through any of the following channels:

• Email: support@gaya9.ws — responses within 4 hours (BST, UTC+6)
• Live Chat: Available 24/7 via the gaya9 platform — average response under 2 minutes
• WhatsApp: +880 1700 000000

All formal data rights requests must be submitted in writing via email. gaya9 will acknowledge receipt within 72 hours and will verify your identity before processing any request that involves disclosure or deletion of personal data.