Privacy Policy

1. Data Controller

For the purposes of this Privacy Policy, gfg66 ("we", "us", "our", "the Company") acts as the data controller in respect of all personal data collected and processed through the gfg66 platform. This means we determine the purposes for which your personal data is used and the manner in which it is processed.

The gfg66 platform is operated for and primarily made available to players located in Bangladesh. All data processing activities described in this Privacy Policy are conducted with reference to the data protection standards applicable to our operational context, including obligations arising under Bangladesh's Digital Security Act and any applicable international best-practice frameworks.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which gfg66 handles your personal data, you may contact our data support team at: [email protected]. We aim to respond to all data-related enquiries within 10 business days of receipt.

2. Information We Collect

gfg66 collects personal data from you in two principal ways: information you provide directly to us, and information collected automatically through your use of the platform. The categories of personal data we process are set out below.

2.1 Information You Provide Directly

• Account registration data: Full legal name, date of birth, residential address (including city — e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi), email address, and mobile phone number;
• Identity verification (KYC) documents: Scanned copies or photographs of government-issued identification such as a Bangladesh National Identity Card (NID), passport, or birth certificate;
• Payment information: Mobile wallet identifiers (bKash, Nagad, Rocket, Upay account numbers), bank account details (BRAC Bank, City Bank, Islami Bank, Sonali Bank), and transaction reference numbers. Raw card or account numbers are never stored on gfg66 servers;
• Communications data: The content of messages, emails, and chat conversations you send to our customer support team;
• Responsible gaming self-declarations: Deposit limit preferences, self-exclusion requests, and session time settings you configure through your account.

2.2 Information Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and unique device identifiers;
• Usage and behavioural data: Pages visited, features used, games played, betting history, session duration, click paths, and in-session navigation patterns;
• Transaction logs: Deposit amounts, withdrawal requests, game round results, bonus claims, and wagering records, all timestamped in Bangladesh Standard Time (BST, UTC+6);
• Cookie and tracking data: Session tokens, preference cookies, and anonymised analytics identifiers as described in Section 6 of this Policy.

3. How We Use Your Data

gfg66 uses the personal data we collect for the following purposes:

gfg66 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review. Fraud-scoring algorithms may flag accounts for review, but any consequential action (such as account suspension) is confirmed by a human compliance officer before implementation.

4. Legal Basis for Processing

gfg66 processes your personal data on the following legal grounds depending on the nature of the processing activity:

• Contractual necessity: Processing required to provide the services you have requested — including account management, game access, payment processing, and withdrawal handling — is carried out because it is necessary to perform our contract with you;
• Legal obligation: Processing required to comply with our KYC, anti-money laundering, and fraud-prevention obligations is carried out to fulfil mandatory legal requirements applicable to our operations;
• Legitimate interests: Processing carried out for platform security, fraud detection, responsible gaming monitoring, and service improvement is based on gfg66's legitimate interests in maintaining a safe, fair, and functional platform, balanced against your interests and fundamental rights;
• Consent: Processing for optional promotional communications (email newsletters, SMS offers, bonus alerts) is based on your explicit opt-in consent. You may withdraw this consent at any time by contacting [email protected] or adjusting your account notification preferences.

5. Data Sharing & Third Parties

gfg66 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share your data only in the limited circumstances described below, and only with parties who are contractually obligated to protect your information.

5.1 Service Providers

We engage the following categories of third-party service providers who may process your personal data on our behalf:

• Payment processors: bKash, Nagad, Rocket (Dutch-Bangla Bank), Upay (UCB), and selected Bangladeshi banking partners process transaction data strictly for payment execution purposes;
• Game content providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other certified studios receive anonymised session and game-round data necessary to operate their games within the gfg66 platform;
• KYC and identity verification partners: Third-party identity verification services may process your submitted documents to confirm your identity and age. These partners operate under strict data processing agreements;
• Fraud and AML screening providers: Specialised compliance platforms receive transaction data and risk signals to assist in detecting money laundering, multi-accounting, and bonus abuse patterns;
• Cloud infrastructure and hosting providers: Server infrastructure used to host the gfg66 platform and store encrypted data operates under binding data security agreements.

5.2 Legal Disclosures

gfg66 may disclose your personal data to law enforcement agencies, regulatory bodies, or other authorised government authorities where required to do so by applicable law, court order, or regulatory directive. We will notify affected players of such disclosures where we are legally permitted to do so.

5.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or a substantial part of gfg66's business assets, your personal data may be transferred to the acquiring entity as part of the transaction. We will provide notice of any such transfer and ensure that the receiving entity is bound by privacy standards no less protective than those described in this Policy.

6. Cookies & Tracking

gfg66 uses cookies and similar tracking technologies (including local storage tokens and session identifiers) to operate and improve the platform. The categories of cookies we deploy are described below.

6.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. They maintain your authenticated session, remember your login state, enforce security tokens, and support the correct operation of the platform's core features. These cookies cannot be disabled without significantly impairing your ability to use gfg66.

6.2 Performance and Analytics Cookies

These cookies collect anonymised data about how players interact with the gfg66 platform — which pages are visited most frequently, how long sessions last, and where users encounter errors. This information is used exclusively to improve platform performance and the overall user experience. No personally identifiable information is collected through these cookies.

6.3 Preference Cookies

These cookies remember your platform preferences, such as your chosen game view settings, notification configurations, and responsible gaming tool settings. They enable gfg66 to present a more personalised experience on subsequent visits.

6.4 What We Do Not Use

gfg66 does not use third-party advertising networks, cross-site tracking pixels, social media retargeting cookies, or any other technology designed to track your browsing behaviour outside of the gfg66 website. You will not receive targeted advertising on other websites as a result of your use of gfg66.

7. Data Retention

gfg66 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. The principal retention periods applicable to each category of data are summarised in the table in Section 3 above.

When your account is closed — whether at your request or by gfg66 — your personal data is not deleted immediately. We are required by financial compliance obligations to retain transaction records, KYC documentation, and anti-money-laundering screening results for a minimum of five to seven years following account closure, depending on the category of data and the applicable regulatory requirement.

At the end of applicable retention periods, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any identifiable individual. Anonymised and aggregated data may be retained indefinitely for statistical and platform-improvement purposes.

8. Data Security

gfg66 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Transport Layer Security (TLS 1.2 and above): All data in transit between your device and gfg66's servers is encrypted using current industry-standard protocols;
• Password hashing: Account passwords are stored using a strong, salted cryptographic hash function. Plain-text passwords are never stored or logged;
• Payment tokenisation: Financial identifiers (mobile wallet numbers, bank account references) are tokenised before storage. Raw account numbers are not held on gfg66's application servers;
• Access control: Access to personal data is restricted to authorised gfg66 personnel and contracted service providers on a strict need-to-know basis. All access events are logged and subject to periodic security audit;
• Intrusion detection and monitoring: gfg66's infrastructure is monitored around the clock for suspicious activity, unauthorised access attempts, and anomalous data patterns;
• Penetration testing: Our platform undergoes regular security assessments by independent security professionals to identify and remediate vulnerabilities before they can be exploited.

While gfg66 takes all reasonable precautions to safeguard your personal data, no system transmitted over the internet can be guaranteed to be completely secure. In the unlikely event of a data breach that poses a significant risk to affected players, gfg66 will notify the relevant authorities and affected individuals in a timely manner in accordance with applicable obligations.

9. Your Privacy Rights

As a player on the gfg66 platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact our support team at [email protected] with your full name, registered email address, and a clear description of your request.

9.1 Right of Access

You have the right to request a copy of the personal data that gfg66 holds about you. We will provide a structured summary of the data we hold, the purposes for which it is processed, and the third parties with whom it has been shared, within a reasonable period of receiving your request.

9.2 Right to Rectification

If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor updates such as changes to your contact email or address can often be made directly through your account settings. For changes to identity-critical fields (legal name, date of birth), documentary evidence will be required.

9.3 Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing and there are no overriding legitimate grounds. Please note that gfg66 is subject to mandatory legal data retention obligations — particularly in relation to financial transaction records and KYC documentation — which may prevent full erasure for a period of up to seven years following your account closure.

9.4 Right to Object

Where gfg66 processes your personal data on the basis of legitimate interests (including fraud prevention monitoring and platform analytics), you have the right to object to that processing. We will assess your objection and cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.

9.5 Right to Withdraw Consent

Where gfg66 processes your data on the basis of your consent (such as for promotional email communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing communications, contact [email protected] or update your notification preferences in your account settings.

10. Changes to This Policy

gfg66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or platform features. When material changes are made to this Policy, we will notify registered players by posting a prominent notice on the gfg66 platform and, where practicable, by sending an email notification to the address registered on your account.

The updated Privacy Policy will be effective from the date indicated at the top of the document. Your continued use of the gfg66 platform following the effective date of any revised Policy constitutes your acknowledgement of the changes. We encourage you to review this page periodically to remain informed about how gfg66 protects your personal data.

If you have any questions about this Privacy Policy — including how we collect, use, store, or share your personal data — please contact our data support team at [email protected]. We are committed to addressing your concerns promptly and transparently, in line with our broader commitment to responsible, player-first platform management. All support communications are conducted in English, Bangladesh Standard Time (BST, UTC+6).