gk322 Privacy Policy

1 Introduction & Scope

This Privacy Policy ("Policy") is published by gk322 ("gk322", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at https://gk322.io and all associated sub-domains and mobile interfaces (collectively, the "Platform"). This Policy explains how gk322 collects, processes, stores, shares, and protects the personal data of individuals who access or use the Platform ("you", "your", "the User").

This Policy applies to all personal data collected in connection with your use of the gk322 Platform, including data collected during account registration, identity verification, financial transactions, gameplay activity, customer support interactions, and your general browsing of the Platform. It applies regardless of whether you access the Platform via a desktop browser, mobile browser, or any other interface.

This Policy should be read alongside the gk322 Terms & Conditions, which are incorporated by reference. By registering an account on gk322 or by continuing to use the Platform after this Policy has been published, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy is effective as of 1 January 2026. Any prior privacy notices published on the Platform are superseded by this document in their entirety.

2 Data Controller

For the purposes of applicable data protection law, gk322 acts as the data controller in respect of all personal data collected from users of the Platform. As data controller, gk322 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

If you have any questions, concerns, or requests relating to the processing of your personal data by gk322, you may contact our dedicated data support team using the contact details provided in Section 15 of this Policy. We are committed to responding to all privacy-related enquiries promptly and in plain, clear English.

3 Data We Collect

gk322 collects personal data in several distinct categories, each serving a defined operational, legal, or security purpose. The principal categories of personal data we collect are as follows:

• Identity Data: Your full legal name, date of birth, and government-issued identification document details (Bangladesh National ID card number, passport number, or equivalent). This data is collected to fulfil our Know Your Customer (KYC) and age verification obligations.
• Contact Data: Your email address, Bangladesh mobile phone number, and city or district of residence (e.g., Dhaka, Chittagong, Sylhet, Rajshahi, Khulna, Barisal, Rangpur, Mymensingh). This data is used for account communication, support, and where you have consented, marketing notifications.
• Financial Data: Your mobile financial service wallet references (bKash, Nagad, Rocket, Upay), bank account references for Dutch-Bangla Bank, City Bank, BRAC Bank, or other approved banking partners, and a complete record of all deposit, withdrawal, and bonus transactions on your account.
• Technical Data: Your IP address at the time of each session, device type and model, operating system version, browser type and version, screen resolution, time zone (Bangladesh Standard Time, UTC+6), and session authentication tokens.
• Usage Data: A detailed record of your activity on the Platform, including games played, bet amounts and outcomes, session durations, pages and features visited, and responsible gaming tool settings applied to your account.
• Communications Data: The content of all communications you initiate with gk322, including live chat transcripts, email correspondence, WhatsApp messages sent to our support channels, and any documents or images you submit as part of a support or verification request.

You are not required to provide all categories of data listed above simply to browse the Platform. However, full account registration and access to funded play — including deposits, withdrawals, and bonus claims — require the provision of Identity, Contact, and Financial Data at minimum.

4 How We Collect Data

gk322 collects personal data through the following primary channels:

• Direct provision: Data you provide directly to gk322 during account registration, identity verification, deposit or withdrawal requests, bonus activation, support interactions, responsible gaming tool requests, and any other form submission on the Platform.
• Automated collection: Technical and usage data collected automatically via server logs, session management systems, and analytics tools as you interact with the Platform. This collection occurs whether or not you are logged into a registered account.
• Third-party verification partners: Identity and address verification data received from KYC / AML service providers engaged by gk322 to validate the documents you submit during account verification. These providers act as data processors under contract with gk322.
• Payment service providers: Transaction reference data received from bKash, Nagad, Rocket, Upay, and our banking partners confirming the status of deposits and withdrawal requests initiated by you on the Platform.
• Cookies and similar technologies: Data collected via cookies, web beacons, and local storage as described in Section 7 of this Policy.

5 How We Use Your Data

gk322 uses the personal data it collects for the following purposes:

• To create, maintain, and administer your gk322 account, including authentication when you use the gk322 Login.
• To verify your identity and age in accordance with responsible gaming obligations. gk322 enforces a strict minimum age of 21 for all registered users.
• To process your deposits and withdrawals via bKash, Nagad, Rocket, Upay, and approved banking channels, and to maintain accurate financial records of all transactions.
• To deliver the games and sports betting markets available on the Platform — including slots from Pragmatic Play, NetEnt, and Microgaming; live casino from Evolution Gaming and Ezugi; and cricket, BPL, IPL, T20, and football betting markets.
• To administer bonuses, free bets, cashback offers, and other promotional benefits in accordance with the applicable offer terms.
• To monitor account activity for signs of problem gambling and to administer responsible gaming tools including deposit limits, session time limits, cool-off periods, and self-exclusion requests.
• To detect, investigate, and prevent fraud, money laundering, collusion, bonus abuse, and other prohibited conduct as defined in the gk322 Terms & Conditions.
• To respond to your customer support requests via live chat, WhatsApp, and email, and to maintain records of those interactions for quality assurance and dispute resolution purposes.
• To send you transactional communications (account confirmations, deposit receipts, withdrawal notifications, security alerts). These communications are sent regardless of your marketing preference settings.
• To send you marketing communications about gk322 promotions, new games, and seasonal offers — but only where you have provided your explicit consent to receive such communications. You may withdraw consent at any time by contacting our support team.
• To comply with applicable laws and regulatory requirements, including anti-money laundering (AML) obligations and any lawful requests from competent authorities.
• To improve the Platform's performance, game selection, user experience, and responsible gaming features through analysis of aggregated, anonymised usage data.

6 Legal Bases for Processing

gk322 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Performance of a contract: Processing necessary to create and manage your account, process transactions, deliver gaming services, and administer bonuses — all activities constituting the performance of the contractual relationship between you and gk322.
• Legal obligation: Processing required to comply with applicable laws, including age verification, identity checks, anti-money laundering obligations, financial record-keeping requirements, and responding to lawful authority requests.
• Legitimate interests: Processing carried out to pursue gk322's legitimate business interests where those interests are not overridden by your rights and interests. This includes fraud detection, security monitoring, platform improvement through anonymised analytics, and responsible gaming monitoring.
• Consent: Processing carried out on the basis of your explicit, freely given, informed, and revocable consent — principally for marketing communications and for the use of non-essential cookies and analytics tracking. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7 Cookies & Tracking Technologies

gk322 uses cookies and similar technologies on the Platform. A cookie is a small text file placed on your device when you visit a website. The following categories of cookies are used by gk322:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They maintain your login session state, remember your account preferences during a session, and enable secure authenticated access. These cookies cannot be disabled without breaking core Platform functionality.
• Performance and analytics cookies: These cookies collect anonymised, aggregated data about how users interact with the Platform — which pages are visited most frequently, how long sessions last, and which features generate the most engagement. This data is used solely to improve the Platform and is not linked to any identifiable individual.
• Security cookies: These cookies support our fraud detection and account security systems, helping to identify unusual login patterns or device mismatches that may indicate unauthorised access attempts.

gk322 does not use third-party advertising cookies or any cookies that track your browsing behaviour outside of the gk322 Platform for advertising profiling purposes. You may manage cookie settings through your browser's privacy controls. Note that disabling strictly necessary cookies may prevent you from accessing certain features of the Platform.

8 Data Sharing & Third Parties

gk322 does not sell, rent, or trade your personal data to any third party for commercial purposes. Your personal data may be shared with third parties only in the following defined circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and other approved payment partners receive the minimum financial data necessary to process your deposits and withdrawals. These providers are contractually bound to use your data solely for transaction processing.
• KYC and AML service providers: Identity verification partners engaged by gk322 to validate identification documents submitted by users during account verification. These providers act as data processors under contract and are not permitted to use your data for any other purpose.
• Game technology providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session data necessary to deliver their games on the Platform. These providers do not receive personally identifiable data beyond what is technically required for game delivery.
• Fraud prevention and security services: Third-party fraud detection and cybersecurity service providers who assist gk322 in identifying and responding to fraudulent activity, account takeover attempts, and other security threats.
• Legal and regulatory authorities: Competent government authorities, law enforcement agencies, financial intelligence units, or courts of competent jurisdiction where gk322 is legally required or otherwise obliged to disclose personal data in response to a lawful request, court order, or regulatory requirement.
• Corporate restructuring: In the event of a merger, acquisition, or sale of all or part of gk322's business, user data may be transferred to the acquiring entity as part of the transaction, subject to equivalent data protection obligations being imposed on the recipient.

9 International Data Transfers

gk322 operates as an offshore-licensed gaming platform. As a result, some of the personal data we collect may be transferred to, stored in, or processed in countries outside Bangladesh. Where such international transfers occur, gk322 takes all reasonable steps to ensure that your personal data continues to receive a level of protection equivalent to that applicable in Bangladesh, including through the use of standard contractual clauses, data processing agreements, and equivalent safeguards with all recipient entities.

By registering an account on gk322 and using the Platform, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Bangladesh where gk322's server infrastructure, payment processors, or game technology partners are located, subject to the safeguards described in this Policy.

10 Data Retention

gk322 retains personal data for no longer than is necessary to fulfil the purposes described in this Policy, subject to any overriding legal retention obligations. The following general retention guidelines apply:

• Active account data: Retained for the full duration of your account's active status plus a minimum of 5 years following account closure, in compliance with standard financial record-keeping and AML obligations.
• Identity verification documents: Retained for a minimum of 5 years from the date of verification, or such longer period as may be required by applicable law.
• Transaction records: All deposit, withdrawal, and bonus transaction records are retained for a minimum of 7 years from the date of the relevant transaction.
• Support communications: Live chat transcripts, email correspondence, and support ticket records are retained for 3 years from the date of the interaction, unless the communication relates to an unresolved dispute, in which case it is retained until final resolution plus 2 years.
• Analytics data: Anonymised, aggregated usage data is retained indefinitely as it does not constitute personal data once anonymisation has been applied. Identified usage data linked to a specific account is retained for the same period as the associated account data.
• Self-excluded accounts: Where a user has requested self-exclusion, the self-exclusion record is retained indefinitely to prevent re-registration. Other account data for self-excluded accounts is retained in accordance with the active account schedule above.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents identification of the data subject.

11 Your Data Rights

As a user of the gk322 Platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team using the details in Section 15:

• Right of access: You have the right to request a copy of all personal data that gk322 holds about you, together with information about how that data is being processed. gk322 will respond to access requests within 30 calendar days of receipt.
• Right to rectification: You have the right to request that gk322 corrects any inaccurate personal data held about you, or completes any incomplete personal data. Requests for rectification will be actioned within 14 calendar days where technically feasible.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and there is no other legal basis for processing), or where processing has been found to be unlawful. This right is subject to any overriding legal retention obligations, including AML and financial record-keeping requirements.
• Right to restrict processing: You have the right to request that gk322 restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to data portability: You have the right to receive a copy of the personal data you have provided to gk322 in a structured, commonly used, machine-readable format, and to request that we transmit that data directly to another data controller where technically feasible.
• Right to object: You have the right to object to the processing of your personal data where that processing is based on gk322's legitimate interests, including profiling for responsible gaming monitoring purposes. Where you object, gk322 will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

12 Data Security

gk322 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL / TLS encryption for all data transmitted between your browser or device and the gk322 Platform.
• Encrypted storage of all personal data on secured, access-controlled servers.
• Tokenisation of sensitive payment data — gk322 does not store complete bKash, Nagad, or bank account credentials on its own infrastructure.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis.
• Regular independent security assessments and penetration testing of the Platform infrastructure.
• Automated monitoring systems detecting and alerting on anomalous access patterns, brute-force login attempts, and other security indicators.
• Staff training on data protection obligations and secure data handling practices.

Notwithstanding the above measures, no online system can guarantee absolute security. In the event of a data breach affecting your personal data, gk322 will notify affected users and relevant authorities in accordance with applicable notification obligations as promptly as the circumstances allow.

You also have an important role in protecting your own data. Please maintain a strong password for your gk322 account, do not share your login credentials with any third party, and contact our support team immediately at [email protected] if you suspect unauthorised access to your account.

13 Children & Minors

The gk322 Platform is strictly for adults aged 21 and above. gk322 does not knowingly collect personal data from any individual under the age of 21. Account registration requires declaration of date of birth, and gk322 conducts age verification checks on all users prior to permitting funded play.

If gk322 becomes aware — through its own verification processes or through a report from a third party — that personal data has been collected from an individual under the age of 21, that data will be deleted immediately, the associated account will be closed, and any deposited funds will be returned to the payment source used. Any play activity conducted by an underage user will be voided and any associated winnings forfeited.

If you believe that a minor in your care has registered an account on gk322, please contact our support team immediately via live chat or at [email protected]. We will investigate and take appropriate action without delay.

14 Changes to This Policy

gk322 reserves the right to amend, update, or replace this Privacy Policy at any time. The most current version of this Policy will always be available at https://gk322.io/privacy-policy with the effective date clearly stated at the top of the document.

Where changes to this Policy are material — for example, where we introduce a new category of personal data collection, a new purpose for processing, or a new category of third-party recipient — gk322 will make reasonable efforts to notify registered users by email or via an in-platform notification prior to the change taking effect. For non-material changes (such as clarifications of existing language), the updated Policy will take effect upon publication without prior individual notification.

Your continued use of the Platform following the publication of any updated version of this Policy constitutes your acknowledgment and acceptance of the revised terms. If you do not agree with the updated Policy, you must stop using the Platform and may request closure of your account by contacting our support team.

15 Contact & Data Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by gk322, please contact our support team using the following contact details:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the Platform
• WhatsApp Support: Available 08:00–24:00 Bangladesh Standard Time (BST, UTC+6)
• Average Response Time: 2–5 minutes via live chat; within 24 hours via email

When submitting a data rights request, please clearly state your registered account username or email address and the nature of your request so that we may respond efficiently and accurately. gk322 may request additional identity verification before processing sensitive data rights requests to ensure we are communicating with the correct account holder.

All privacy-related correspondence will be handled in English. gk322 is committed to resolving all data protection enquiries in a timely, fair, and transparent manner consistent with the principles described in this Policy.