gamba Privacy Policy

1. Data We Collect

gamba collects personal data from members and platform visitors through several channels: directly from you when you register an account, make a deposit, or contact support; automatically as you use the platform through session cookies and device signals; and from trusted third-party identity verification and payment processing partners. We collect only what is necessary to operate the platform safely, legally, and fairly.

1.1 Registration Data

When you create a gamba account, we collect the following information:

• Full legal name (as it appears on your NID or passport)
• Date of birth (to verify that you meet the 18+ age requirement)
• Residential address (city, district, and division within Bangladesh)
• Valid email address
• Bangladeshi mobile phone number
• Chosen username and encrypted password hash

1.2 Identity Verification (KYC) Data

Before withdrawals are enabled on your account, gamba is required to verify your identity. During this KYC process we may collect and temporarily store:

• Scanned or photographed copy of your Bangladesh National Identity Card (NID), passport, or driving licence
• A proof-of-address document (utility bill, bank statement, or government letter dated within the last three months)
• A selfie photograph or short video for liveness verification where required
• Confirmation documents for your registered payment method (bKash, Nagad, Rocket, bank account)

Identity documents are processed by our verification partner and stored in encrypted form. Physical document images are not retained beyond the period necessary to complete and record the verification outcome.

1.3 Transaction Data

Every deposit, withdrawal, bonus credit, and wagering transaction on your gamba account generates a transaction record. This record includes the amount in Bangladeshi Taka (BDT), the payment method used (e.g., bKash, Nagad, Rocket, Upay, bank transfer), the timestamp in Bangladesh Standard Time (BST, UTC+6), and the transaction status. Transaction records are retained for a minimum of five years to satisfy financial record-keeping obligations.

1.4 Gameplay Data

gamba records data about your gaming activity on the platform, including game sessions, bet amounts and outcomes, game titles and providers accessed, session start and end times, and responsible gaming tool usage (deposit limits set, cool-off periods applied, self-exclusion requests). This data is used to provide game history to members, to detect irregular or prohibited activity, and to fulfil our responsible gaming monitoring obligations.

1.5 Technical and Device Data

When you access gamba we automatically collect certain technical signals, including:

• IP address and approximate geolocation (country and city level)
• Browser type, version, and language setting
• Device type (desktop, mobile, tablet) and operating system
• Referral URL (the page you visited immediately before arriving at gamba.im)
• Session duration and page interaction data

This technical data is used for fraud detection, platform security, and aggregate performance analytics. It is not used to build individual advertising profiles.

2. How We Use Your Data

gamba processes your personal data only for purposes that are lawful, specific, and proportionate. The table below summarises the primary purposes for which we use member data and the legal basis we rely on for each processing activity.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you without human review. Where our fraud detection systems flag an account for investigation, the final decision on any account action is reviewed by a member of the gamba compliance team.

3. Data Sharing & Third Parties

gamba does not sell your personal data. We share data only with trusted third-party service providers that are contractually bound to process it solely for the purposes we specify, and only where such sharing is necessary to deliver the platform services you have contracted for. Categories of third parties with whom we share data include:

3.1 Identity Verification Partners

We work with certified KYC verification service providers to validate identity documents and conduct liveness checks. These partners receive the KYC documents you submit and return a verification result. They are prohibited from using your identity data for any purpose other than the verification requested by gamba.

3.2 Payment Processing Partners

To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard, we share the minimum transaction information required by each payment partner to complete the transfer. gamba does not store full card numbers or full mobile banking PINs — these are handled exclusively by the relevant payment provider's secure gateway.

3.3 Game Software Providers

Casino games offered on gamba are provided by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game from one of these studios, your anonymised session data (bet amounts, outcomes, session ID) is transmitted to the game server operated by the respective studio. No directly identifying personal data (name, NID, email) is shared with game providers.

3.4 Legal and Regulatory Disclosures

gamba may disclose personal data to law enforcement agencies, financial intelligence units, or other government bodies where we are legally compelled to do so — for example, in response to a court order or a lawful request related to anti-money laundering investigations. We will notify the affected member of any such disclosure wherever permitted by law.

4. Cookies & Tracking

gamba uses cookies and similar local storage technologies on the platform. Cookies are small text files stored on your device that help the platform function correctly and allow us to understand how the platform is being used at an aggregate level.

4.1 Types of Cookies We Use

4.2 Third-Party Cookies

gamba does not deploy third-party advertising cookies, retargeting pixels, or social media tracking scripts. The analytics technologies we use operate under a data processing agreement that prevents the analytics provider from using your data for their own commercial purposes.

4.3 Managing Cookies

You may control or delete cookies through your browser settings. Note that disabling strictly necessary cookies will prevent the platform from functioning correctly — you will not be able to log in or complete transactions with essential cookies disabled. Disabling functional or analytics cookies will not affect your ability to play games or manage your account but may degrade certain personalisation features.

5. Data Retention

gamba retains personal data only for as long as is necessary to fulfil the purpose for which it was collected or to comply with applicable legal, regulatory, and financial record-keeping obligations. The following retention periods apply:

• Active account data (registration details, contact information): Retained for the full duration your account is active plus five years after account closure.
• KYC verification records (document scans, verification outcomes): Retained for five years after account closure to satisfy anti-money laundering record-keeping requirements.
• Transaction records (deposits, withdrawals, gameplay history): Retained for a minimum of five years from the date of each transaction.
• Support correspondence (emails, chat transcripts): Retained for two years after the support case is closed.
• Marketing consent records: Retained for three years after consent is withdrawn, to demonstrate compliance with opt-in requirements.
• Technical and device data: Anonymised within 12 months of collection; raw log data deleted within 90 days.

Upon expiry of the relevant retention period, personal data is securely deleted or irreversibly anonymised. Where deletion is not immediately technically feasible (e.g., data held in encrypted backup archives), the data is isolated from active processing and deleted at the next scheduled archive purge cycle.

6. Data Security

gamba implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or destruction. Our security practices include:

• TLS 1.2/1.3 encryption for all data in transit between your browser and the gamba platform.
• AES-256 encryption for sensitive data at rest, including KYC document stores and payment method references.
• Bcrypt password hashing — your password is never stored in plain text. We store only a salted cryptographic hash.
• Access controls and least-privilege principles — only staff members with a documented operational need may access member personal data, and all such access is logged and audited.
• Intrusion detection and rate limiting on all authentication endpoints to prevent brute-force attacks.
• Regular penetration testing conducted by independent security professionals to identify and remediate vulnerabilities.
• Incident response procedures — in the event of a data breach that poses a risk to member rights, gamba will notify affected members and relevant authorities within 72 hours of becoming aware of the incident.

7. Your Privacy Rights

As a gamba member, you hold the following rights over the personal data we hold about you. To exercise any of these rights, submit a request to [email protected] from the email address registered to your account. We will verify your identity before processing any data request and will respond within 30 calendar days.

• Right of Access: You may request a copy of all personal data gamba holds about you, including your registration details, KYC records, transaction history, and gameplay data.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you have the right to request that it be corrected. Some fields (such as your verified legal name) can only be updated through the KYC re-verification process.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (for consent-based processing), or where the data has been processed unlawfully. Note that gamba may be legally required to retain certain data (e.g., transaction records, KYC outcomes) even after an account closure request.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances — for example, while you contest the accuracy of the data or while a complaint is being investigated.
• Right to Data Portability: For data that you have provided to us directly and which is processed on the basis of consent or contractual necessity, you may request a copy in a structured, machine-readable format (CSV or JSON).
• Right to Withdraw Consent: Where we process your data on the basis of your consent (such as for marketing communications), you may withdraw that consent at any time through your account communication preferences or by emailing [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to Object: You may object to processing based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

8. Contact & Data Inquiries

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about how gamba handles your personal information, please contact our data team at the address below. All privacy-related correspondence is treated as confidential and handled by authorised personnel only.

Data Inquiries: [email protected]
Subject Line: Privacy Request — [Your Registered Username]
Response Time: Within 30 calendar days of identity verification

We take all privacy complaints seriously. If you submit a complaint and are not satisfied with our response, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction.