Privacy Policy — How gh88 Collects, Uses, and Protects Your Data

1 Introduction

gh88 ("we", "us", "our") is committed to protecting and respecting the privacy of every individual who accesses or uses the gh88 online betting and casino platform at gh88.biz (the "Platform"). This Privacy Policy sets out the basis on which we collect, use, store, disclose, and otherwise process personal data obtained from or about you in connection with your use of the Platform.

This Privacy Policy should be read alongside the gh88 Terms & Conditions and the Responsible Gaming policy, each of which forms part of the agreement between you and gh88. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

gh88 is designed and operated specifically for the Bangladesh market. The Platform operates in English and all communications, notices, and data processing activities are conducted in English (Bangladesh Standard Time, UTC+6).

2 Data Controller

For the purposes of applicable data protection law, gh88 acts as the data controller in respect of personal data collected through the Platform. As data controller, gh88 determines the purposes for which, and the means by which, your personal data is processed.

All data protection queries, subject access requests, and privacy-related concerns should be directed to the gh88 data protection contact point:

• Email: [email protected]
• Subject Line: "Data Protection Query — [Your Account Username]"
• Response Time: Within 30 days of receipt of a valid request

3 Data We Collect

gh88 collects personal data from you through several distinct channels. The categories of data we collect are described below.

3.1 Registration Data

When you create a gh88 account, we collect:

• Full legal name
• Date of birth (to verify you meet the 21+ age requirement)
• Residential address (district, city, and division within Bangladesh)
• Mobile number registered to your bKash, Nagad, Rocket, or Upay account
• Username and hashed password credential

3.2 Identity Verification (KYC) Data

To comply with responsible gaming and platform integrity obligations, we may request:

• A copy of your National Identity Card (NID) or valid passport
• A recent utility bill or bank statement as proof of current address
• A selfie photograph for live document verification purposes

3.3 Transaction Data

For every deposit and withdrawal processed through the Platform, we record:

• Mobile wallet identifier (bKash / Nagad / Rocket / Upay account number — stored in encrypted form)
• Transaction amount in BDT
• Transaction timestamp (Bangladesh Standard Time)
• Transaction reference number issued by the payment service provider
• Transaction status (pending, completed, failed, reversed)

3.4 Betting and Gaming Activity Data

We record a complete log of your betting and gaming activity on the Platform, including:

• All sports bets placed (market, selection, stake, odds, outcome)
• All casino and slot game sessions (game title, session duration, stake, result)
• Bonus claims, wagering progress, and bonus settlement records
• Responsible gaming tool activations (deposit limits set, cooling-off periods, self-exclusion requests)

3.5 Technical and Device Data

When you access the Platform, our servers automatically collect:

• IP address
• Device type and operating system
• Browser type and version
• Referring URL and navigation path within the Platform
• Session duration and page interaction data
• Time zone setting (used to determine your approximate geographic location)

3.6 Communications Data

We retain records of all communications between you and gh88 support, including emails sent to [email protected], in-platform support chat transcripts where applicable, and any formal complaints submitted. These records are retained for the purposes of dispute resolution and service quality monitoring.

4 How We Use Your Data

gh88 uses the personal data described in Section 3 for the following specific purposes:

gh88 does not use automated decision-making processes that produce legal or similarly significant effects on Players, except where automated systems flag accounts for fraud or responsible gaming review — in which case a human review is always conducted before any account action is taken.

5 Legal Basis for Processing

gh88 processes your personal data under the following legal bases:

• Contractual necessity: Processing required to create your account, accept bets, process payments, and deliver the services you have registered to use.
• Legitimate interests: Processing carried out for fraud prevention, platform security, abuse detection, responsible gaming monitoring, and service improvement — where these interests are not overridden by your fundamental rights and freedoms.
• Legal obligation: Processing required to comply with anti-money laundering obligations, age verification requirements, and any other applicable legal duties.
• Consent: Where we rely on your consent (for example, to send you promotional communications), you may withdraw that consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

6 Cookies & Tracking Technologies

6.1 What We Use

The gh88 Platform uses cookies and similar tracking technologies to operate core platform functions, maintain your login session, remember your preferences, and gather aggregated analytics data about how the Platform is used. The categories of cookies we deploy are as follows:

• Strictly Necessary Cookies: Required to keep you logged in, maintain your betting session state, and secure your account. These cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Store your preferences such as language setting, odds format preference, and notification settings to improve your experience across sessions.
• Analytics Cookies: Collect anonymised, aggregated data about page visits, session durations, and feature usage to help gh88 identify and resolve performance issues and improve the Platform. No personally identifiable data is transmitted via analytics cookies.

6.2 Managing Cookies

You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from accessing your gh88 account and using Platform services. gh88 does not use third-party advertising cookies or cross-site tracking cookies of any kind.

7 Third-Party Sharing

7.1 Payment Service Providers

To process your deposits and withdrawals, gh88 must share the minimum necessary transaction data with your chosen payment service provider (bKash, Nagad, Rocket, or Upay). This sharing is limited to the data required to initiate, authorise, and confirm the transaction. gh88 does not share your betting history, account balance details, or KYC documents with payment service providers.

7.2 Game Studio Partners

Casino and slot games on the gh88 Platform are provided under commercial licence by third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These studios' game servers process your in-game session data (stake, game actions, round outcome) in real time as part of delivering the game to you. Game studios receive session-level technical data only and do not receive your personal registration details or payment information.

7.3 Legal and Regulatory Disclosure

gh88 may disclose your personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, court order, or in connection with the investigation of suspected fraud, money laundering, or other criminal activity. gh88 will provide only the minimum data necessary to satisfy the legal obligation and will, where permitted by law, notify you of such disclosure.

7.4 No Sale of Data

gh88 does not sell, rent, trade, or otherwise transfer your personal data to any unaffiliated third party for commercial or marketing purposes. Any sharing of data is limited strictly to the categories described in this Section 7 and is governed by appropriate data processing agreements where applicable.

8 Payment Data Security

gh88 takes the security of payment-related data with particular seriousness given the financial nature of the Platform. The following specific measures apply to payment data:

• Mobile wallet account numbers (bKash, Nagad, Rocket, Upay) are stored in encrypted form using AES-256 encryption. They are never stored in plain text.
• Payment data is transmitted exclusively over TLS-encrypted connections. Unencrypted transmission of payment data is not permitted under any operational procedure.
• gh88 staff do not have direct access to your full mobile wallet account number. Internal systems display only the last four digits for identification purposes.
• All withdrawal requests are subject to a manual review step that verifies the destination account matches the registered account holder's name before release.
• gh88 does not process international card payments and therefore does not store credit or debit card numbers, CVV codes, or card expiry dates on its systems.

9 Data Retention

gh88 retains different categories of personal data for different periods, determined by operational necessity, legal obligation, and responsible gaming audit requirements:

• Account registration and KYC data: Retained for a minimum of five (5) years following the date of permanent account closure or the date of last activity, whichever is later. This retention period supports anti-money laundering compliance and responsible gaming audit obligations.
• Transaction records: Retained for a minimum of five (5) years following each transaction date, in accordance with financial record-keeping requirements.
• Betting and gaming activity logs: Retained for a minimum of three (3) years following account closure for dispute resolution and responsible gaming monitoring purposes.
• Customer support communications: Retained for two (2) years following the resolution of the relevant support interaction.
• Technical and device data (server logs): Retained on a rolling 12-month basis. Logs older than 12 months are purged automatically unless flagged for a specific investigation.
• Cookie and session data: Session cookies expire at the end of each browser session. Persistent functional cookies expire within 30 days of last interaction.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be attributed to any individual.

10 Your Rights

As a gh88 Platform user, you hold the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact [email protected] with the subject line "Data Rights Request — [Your Account Username]".

• Right of Access: You may request a copy of the personal data gh88 holds about you, along with information about how that data is being used.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held in your account record.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations that may require us to retain certain data for a defined period after account closure.
• Right to Restriction of Processing: You may request that gh88 restrict processing of your personal data in certain circumstances — for example, while the accuracy of data is contested or while an objection to processing is under review.
• Right to Data Portability: You may request that gh88 provide your personal data in a structured, commonly used, machine-readable format, and transmit it to another controller where technically feasible.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming purposes, where you have grounds relating to your particular situation. gh88 will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

gh88 will respond to all valid rights requests within 30 days. Where a request is complex or involves a large volume of data, gh88 may extend this period by a further 30 days, with notice to you explaining the reason for the extension.

11 Children's Privacy

The gh88 Platform is strictly intended for adults aged 21 and above. gh88 does not knowingly collect or process personal data from individuals under the age of 21. If gh88 becomes aware that personal data has been collected from an individual under 21 — whether through registration, payment activity, or any other means — that account will be immediately suspended, all data associated with the account will be reviewed, any winnings will be forfeited, and the account will be permanently closed.

If you are a parent or guardian and have reason to believe that a person under the age of 21 in your care has created a gh88 account, please contact [email protected] immediately with the subject line "Underage Account Report". gh88 will treat such reports as a priority and will act promptly to investigate and close the account.

12 International Transfers

gh88 operates a platform designed primarily for users based in Bangladesh. The majority of data processing activities take place within the operational infrastructure of the Platform. However, certain data may be processed outside Bangladesh in the following limited circumstances:

• Game studio servers: Real-time game session data processed by Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other studio partners may be processed on servers located in the European Union, Malta, Gibraltar, or other jurisdictions where those studios maintain their infrastructure.
• Platform infrastructure: gh88's hosting and content delivery infrastructure may utilise servers in multiple geographic locations to ensure performance and availability for Bangladeshi users. All such infrastructure operates under the same security and encryption standards described in this Privacy Policy.

Where personal data is transferred internationally, gh88 ensures that appropriate safeguards are in place — including contractual clauses in agreements with data processors — to ensure that your data is protected to a standard equivalent to that described in this Privacy Policy, regardless of where processing occurs.

13 Security Measures

gh88 implements a multi-layered technical and operational security framework to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and the gh88 Platform.
• AES-256 encryption at rest for all sensitive stored data including payment identifiers and KYC documents.
• Access controls: Personal data is accessible only to gh88 operational personnel with a defined business need. Access is role-based and subject to audit logging.
• Two-factor authentication on all internal systems used by gh88 staff to access Player data.
• Regular security reviews of Platform infrastructure, including penetration testing and vulnerability assessments carried out on a scheduled basis.
• Incident response procedures ensuring that any confirmed data breach is assessed, contained, and reported (where required) within 72 hours of detection.

Despite these measures, no data transmission or storage system is entirely without risk. gh88 cannot guarantee absolute security against all possible threats. You can reduce your personal risk by using a strong, unique password for your gh88 account, enabling two-factor authentication where offered, and logging out of your account after each session.

14 Amendments to This Policy

gh88 reserves the right to update or amend this Privacy Policy at any time. When material changes are made, the effective date at the top of this document will be updated and, where practicable, registered Players will be notified via email to the address registered to their account or via a prominent in-Platform notice. The most current version of this Privacy Policy will always be accessible at gh88.biz/privacy-policy.

Your continued use of the gh88 Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should cease using the Platform and may request closure of your account and withdrawal of your balance by contacting [email protected].

15 Contact

For all privacy-related queries, data subject rights requests, and data protection concerns, please contact gh88 using the details below:

• Email: [email protected]
• Subject Line: "Privacy Query — [Your Account Username]" or "Data Rights Request — [Your Account Username]"
• Response Time: Within 30 days of receipt of a valid request
• Support Hours: 24 hours a day, 7 days a week including Bangladeshi public holidays

For urgent responsible gaming matters — including requests to self-exclude or set emergency deposit limits — please use the subject line "Responsible Gaming — Urgent" to ensure prioritised handling.