gd89 Privacy Policy —
How We Protect Your Personal Data

This Privacy Policy ("Policy") describes how gd89 ("we", "us", "our") collects, uses, stores, and discloses personal data relating to individuals ("you", "your", "Player") who register for or use the gd89 online betting platform at https://gd89.io. This Policy applies to all users of the Platform regardless of how they access it — whether via desktop browser, mobile browser, or any other device.

By registering an account on gd89, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform and request account closure by contacting [email protected].

This Policy should be read alongside gd89's Terms & Conditions and Responsible Gaming Policy, both of which are available on the Platform. In the event of any conflict between this Policy and the Terms & Conditions, the Terms & Conditions shall prevail unless the conflict specifically concerns data protection, in which case this Policy shall govern.

gd89 collects personal data across several categories, depending on the nature of your interaction with the Platform. The categories of data we hold are described in the table below:

gd89 does not intentionally collect special-category sensitive data (such as racial or ethnic origin, health data, or religious beliefs) unless voluntarily provided by the Player in the course of a support interaction. Any such data shared incidentally is not stored beyond the resolution of the relevant support case.

gd89 collects personal data through the following primary channels:

• Direct submission — Data you actively provide when completing the registration form, submitting KYC documents, making a deposit, requesting a withdrawal, or contacting the support team.
• Automated technical collection — Technical and behavioural data collected automatically by our servers and analytics systems when you access or use the Platform, including IP addresses, device identifiers, and session logs.
• Cookies and similar technologies — Persistent and session cookies, pixel tags, and local storage mechanisms used to maintain your session state, remember preferences, detect fraud, and analyse usage patterns. See Section 7 for full details.
• Payment processors — Confirmation data returned by bKash, Nagad, Rocket, Upay, Visa, and Mastercard gateways when a transaction is initiated or completed. gd89 does not store full payment credentials; this data is handled by the respective payment provider.
• Third-party KYC providers — Identity verification results returned by our KYC service partners when processing NID or passport checks during account verification.
• Fraud detection services — Behavioural risk signals and device fingerprinting data provided by our fraud detection partners to help identify suspicious account activity.

gd89 processes your personal data for clearly defined purposes. We do not use your data for any purpose beyond those listed below without first obtaining your explicit consent:

• Account creation and management — To register your account, verify your identity, maintain your profile, and allow you to log in securely to the Platform.
• Service delivery — To allow you to place bets, play casino games, access slots, and participate in promotions offered on gd89.
• Payment processing — To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard in Bangladeshi Taka (BDT).
• Identity verification (KYC) — To verify that you are who you claim to be, that you meet the minimum age requirement of 21 years, and that your payment methods belong to you.
• Fraud prevention and security — To detect, investigate, and prevent fraudulent transactions, money laundering, account takeovers, and other prohibited conduct as defined in the Terms & Conditions.
• Legal compliance — To meet record-keeping, reporting, and audit obligations required by applicable anti-money-laundering (AML) and counter-terrorism-financing (CTF) regulations.
• Customer support — To respond to your queries, resolve complaints, and provide technical assistance in English and Bengali.
• Responsible gaming — To monitor betting patterns that may indicate problem gambling and to apply responsible gaming tools such as deposit limits and self-exclusion at the Player's request or on a mandatory basis where appropriate.
• Platform improvement — To analyse aggregate usage data and improve the design, performance, and product offering of gd89.
• Direct marketing — To send you promotional offers, bonus notifications, and relevant updates by SMS or email, but only where you have provided explicit consent to receive such communications. You may opt out at any time.

Each category of data processing conducted by gd89 rests on one or more recognised legal bases. We rely on the following bases, applied as appropriate to each specific processing activity:

• Contractual necessity — Processing required to fulfil our obligations under the Terms & Conditions agreement between you and gd89, including account management, payment processing, and service delivery.
• Legal obligation — Processing required to comply with applicable laws, including AML/CTF record-keeping requirements and responses to lawful requests from regulatory or law enforcement authorities.
• Legitimate interests — Processing conducted for gd89's legitimate business interests where these are not overridden by your rights, including fraud detection, platform security, internal analytics, and responsible gaming monitoring.
• Consent — Processing based on your freely given, specific, and informed consent, including direct marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

gd89 does not sell your personal data. We share personal data only in the limited circumstances described below, and only with parties who are contractually bound to handle it with an appropriate level of security and confidentiality:

• Payment service providers — bKash, Nagad, Rocket, Upay, Visa, and Mastercard processor networks receive the minimum data necessary to process your deposit or withdrawal transactions.
• KYC and identity verification providers — Our KYC partners receive identity documents and personal data submitted during account verification for the sole purpose of confirming identity and age.
• Fraud prevention and risk management services — Specialist fraud detection providers receive technical and behavioural data to identify potentially fraudulent or suspicious activity.
• Game software providers — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other game studios receive session data necessary to deliver and log gameplay. These providers operate under their own data protection frameworks.
• IT infrastructure and hosting providers — Cloud infrastructure and data centre providers who host gd89's servers are contractually obligated to maintain the confidentiality and security of all data they process on our behalf.
• Legal and regulatory authorities — gd89 may disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies where required by law, court order, or in connection with the investigation of suspected financial crime.
• Professional advisers — Legal counsel, auditors, and compliance consultants may access data on a strictly need-to-know basis, subject to professional confidentiality obligations.

In all cases where data is shared with third parties, gd89 requires appropriate data processing agreements to be in place and conducts due diligence on the data handling practices of its partners.

gd89 uses cookies and similar tracking technologies to operate the Platform, maintain your session, personalise your experience, and analyse usage patterns. The types of cookies we use are categorised as follows:

• Strictly necessary cookies — Essential for the Platform to function. These include session authentication cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without breaking Platform functionality.
• Functional cookies — Used to remember your preferences, such as your chosen language (English) and display settings, so that you do not need to re-enter them on each visit.
• Performance and analytics cookies — Used to collect aggregated, anonymised data about how players use the Platform — which pages are visited most, how long sessions last, and where navigation errors occur. This data helps us improve the Platform.
• Fraud detection cookies — Used to collect device fingerprinting signals that help identify unusual account activity patterns consistent with fraudulent behaviour or the use of automated tools.

You may control non-essential cookies through your browser settings. Most modern browsers allow you to refuse or delete cookies. Note that disabling strictly necessary cookies will prevent you from logging in and using core Platform features. gd89 does not currently use third-party advertising cookies or retargeting pixels from external ad networks.

gd89 implements a layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our key security measures include:

• Transport Layer Security (TLS) — All data transmitted between your device and gd89's servers is encrypted using 256-bit TLS (HTTPS). Unencrypted HTTP connections are automatically redirected to HTTPS.
• Data-at-rest encryption — Sensitive data stored on our servers, including identity documents and financial records, is encrypted at rest using AES-256 encryption.
• Access controls — Access to personal data is restricted to authorised gd89 personnel and service providers on a strict need-to-know basis. All internal access is logged and subject to audit.
• Two-factor authentication (2FA) — SMS-based two-factor authentication is available for all player accounts and is strongly recommended. Administrative access to internal systems requires 2FA by default.
• Penetration testing — gd89 conducts periodic security assessments and penetration tests on its Platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident response — gd89 maintains a documented security incident response plan. In the event of a data breach, affected players will be notified within 72 hours where feasible, as described in Section 1.

gd89 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any overriding legal obligation to retain it for a longer period. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

As a user of the gd89 Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, contact [email protected] with the subject line "Data Rights Request — [your username]". We will respond within 7 business days:

• Right of access — You may request a copy of all personal data gd89 holds about you, along with information about how it is processed and the legal basis for that processing.
• Right to rectification — If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected or updated. Identity and contact data can also be updated directly from your account dashboard.
• Right to erasure ("right to be forgotten") — You may request deletion of your personal data where it is no longer necessary for the purposes it was collected, where you have withdrawn consent, or where you object to its processing. This right is subject to overriding legal retention obligations (see Section 9).
• Right to restriction — You may request that gd89 restrict the processing of your data in certain circumstances — for example, while a correction request is being verified or while an objection is being assessed.
• Right to data portability — You may request a structured, machine-readable copy of personal data you have provided to gd89, to the extent that such data is processed on the basis of consent or contractual necessity.
• Right to object — You may object to processing based on legitimate interests at any time. gd89 will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw marketing consent — You may opt out of receiving promotional SMS or email communications at any time by following the unsubscribe instructions in any marketing message or by contacting [email protected].

gd89 strictly prohibits access to the Platform by any person under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. If we discover that an account has been registered by a person under 21, we will immediately close the account, cease processing the associated personal data, delete it to the extent permitted by law, and return any deposited funds to the originating payment method.

If you are a parent or guardian and believe that a minor in your care has registered an account on gd89, please contact us immediately at [email protected]. We will investigate and act on all such reports promptly. Age verification is a mandatory step in the KYC process, and we rely on the NID or passport documents submitted by the account holder to confirm eligibility.

The gd89 Platform integrates with a number of third-party service providers to deliver its full range of features. These include game software studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, as well as payment processors and analytics providers. Each of these third parties operates under its own privacy policy and data protection framework.

gd89 is not responsible for the privacy practices of third-party game providers or payment processors. When you interact with a game powered by a third-party studio, or initiate a payment via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, your data may also be processed by that third party in accordance with their own terms. We encourage you to review the privacy policies of these third parties where relevant.

gd89 does not permit third-party providers to use your personal data for their own independent marketing purposes. Any data shared with third parties is limited to what is strictly necessary for the delivery of the relevant service.

gd89 primarily serves players located in Bangladesh, and the majority of data processing takes place on infrastructure hosted within or near the Asia-Pacific region to minimise latency and comply with data localisation best practices. However, some of our service providers — including certain game studios, fraud detection platforms, and cloud infrastructure providers — may process data in jurisdictions outside Bangladesh.

Where personal data is transferred internationally, gd89 ensures that appropriate safeguards are in place. These may include standard contractual clauses incorporated into data processing agreements, the use of providers operating in jurisdictions with recognised adequate levels of data protection, or other lawful transfer mechanisms as applicable.

By using the gd89 Platform, you acknowledge that your personal data may be transferred to and processed in countries outside Bangladesh where data protection laws may differ from those applicable in your country of residence. gd89 takes all reasonable steps to ensure that such transfers are subject to appropriate protections and that your rights are maintained regardless of where processing occurs.

gd89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or the features and services offered on the Platform. All amendments will be posted at https://gd89.io/privacy-policy with an updated effective date.

Where a change is material — meaning it significantly affects the way we collect, use, or share your personal data — gd89 will provide advance notice to registered players via the email address on file, no less than 14 days before the change takes effect. Continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

If you disagree with any changes to this Policy, you have the right to close your account by contacting [email protected] before the revised Policy takes effect. We will process your account closure and return any outstanding balance in accordance with the Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way gd89 handles your personal data, please contact our support team using the details below. All privacy-related enquiries are handled by trained staff and treated with strict confidentiality.

If you are not satisfied with the response you receive from gd89's support team, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. gd89 is committed to cooperating fully with any regulatory investigation into our data handling practices.

This Privacy Policy was last reviewed and updated on 1 January 2026. It supersedes all previous versions of the gd89 Privacy Policy. The English-language version of this Policy is the authoritative version and shall prevail in the event of any discrepancy with any translated version.