gh888 Privacy Policy

1. Who We Are

gh888 is an online sports betting and casino platform operating at gh888.io, designed and marketed for players in Bangladesh. References in this Privacy Policy to "gh888", "we", "us", or "our" refer to the operator of the gh888 platform and its affiliated entities responsible for the collection and processing of personal data described herein.

gh888 acts as the data controller in respect of the personal data of registered players and visitors to the gh888 platform. As data controller, gh888 determines the purposes and means by which personal data is processed. All questions and requests relating to data protection may be directed to the gh888 support team at the contact details provided in Section 15 of this policy.

2. Personal Data We Collect

gh888 collects the following categories of personal data from players and visitors to the gh888 platform:

2.1 Registration and Identity Data

• Full legal name as it appears on your government-issued identification.
• Date of birth (used to verify that you are 21 years of age or older).
• Residential address, including district, city, and postcode within Bangladesh.
• Mobile phone number (used for account verification, SMS two-factor authentication, and support communications).
• Email address (used for account notifications, promotional communications where consented, and password resets).
• Username and encrypted password hash (your raw password is never stored).

2.2 Identity Verification Documents

• Copy of your National Identity Card (NID), passport, or other government-issued photo ID, requested when gh888 requires identity verification prior to processing a withdrawal or where a compliance check is triggered.
• Proof of address document such as a utility bill or bank statement, if required as part of enhanced due diligence.
• Selfie photograph with your ID document, where requested for remote identity verification.

2.3 Financial and Transaction Data

• Payment method reference identifiers (for example, a bKash wallet number, Nagad account reference, or last four digits of a card). Full payment credentials such as full card numbers, PINs, and bank passwords are never stored by gh888.
• Deposit and withdrawal transaction history including amounts in BDT, timestamps, and payment method used.
• Wagering history including bet amounts, bet types, markets, game titles, and outcomes.
• Account balance information at any given point in time.

2.4 Technical and Usage Data

• IP address at login and during active sessions.
• Device type, operating system, and browser or app version.
• Session duration, pages visited, and features used within the gh888 platform.
• Geolocation data at a city or district level, derived from your IP address.
• Cookie identifiers and session tokens as described in Section 8.

2.5 Communications Data

• Records of support interactions via live chat, email, or any other channel through which you communicate with gh888.
• Feedback and survey responses, where voluntarily provided.
• Preferences indicated during account setup, such as notification settings and responsible gaming limits.

3. How We Collect Your Data

gh888 collects personal data through the following means:

• Directly from you — when you register an account, complete identity verification, make a deposit or withdrawal, place a bet, contact support, or update your account settings.
• Automatically during platform use — through cookies, session tokens, and server-side logging that records technical usage data such as IP address, device information, and page interaction data.
• From payment providers — when you initiate a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a bank partner, gh888 receives a transaction confirmation and reference identifier from the relevant payment gateway.
• From identity verification services — where gh888 uses a third-party identity verification partner to cross-check document authenticity, that partner may return a verification status and confidence score to gh888.
• From fraud prevention and security partners — gh888 may receive risk signals or flags from fraud detection services that are cross-referenced against your account activity to protect platform integrity.

4. How We Use Your Personal Data

gh888 uses the personal data collected for the following specific purposes:

gh888 does not use personal data for any purpose not listed above without first notifying you and, where required, obtaining your consent.

5. Legal Basis for Processing

gh888 processes personal data under one or more of the following legal bases, each of which is identified in the table in Section 4:

• Contract Performance: Processing is necessary to perform the contract between gh888 and you as a registered player — that is, to operate your account, process bets, and handle payments.
• Legal Obligation: Processing is required to comply with applicable legal requirements, including age verification obligations, anti-money laundering checks, and the retention of financial records.
• Legitimate Interest: Processing is necessary for gh888's legitimate business interests, including fraud prevention, platform security, and improving the quality of the gh888 service, provided those interests do not override your fundamental rights.
• Consent: Where gh888 relies on your consent as the legal basis for processing — principally for sending promotional communications — you may withdraw that consent at any time by updating your notification preferences in your account settings or by contacting support.

6. How We Share Your Data

gh888 does not sell, rent, or trade your personal data to third parties for commercial purposes. Your data may be shared with third parties only in the following circumstances:

6.1 Service Providers

gh888 engages carefully selected third-party service providers to assist in operating the platform. These providers act as data processors under contract and are permitted to use your data only to perform the specific service for which they are engaged. Categories of service providers include:

• Payment gateway operators (including bKash, Nagad, Rocket, Upay, bank partners, Visa, and Mastercard processing networks) — for the purpose of processing deposits and withdrawals.
• Identity verification service providers — for the purpose of verifying the authenticity of identity documents submitted during account verification.
• Fraud detection and risk management providers — for the purpose of identifying unusual account activity and protecting against financial crime.
• Game content providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — these providers may receive a session token to authenticate your gameplay but do not receive your full personal profile.
• Cloud hosting and infrastructure providers — for the purpose of securely hosting gh888 platform data and ensuring service availability.
• Customer support tooling providers — for the purpose of managing and recording support interactions.

6.2 Legal and Regulatory Disclosure

gh888 may disclose your personal data to law enforcement authorities, regulatory bodies, or courts where required to do so by applicable law, valid legal process, or a binding governmental order. gh888 will make reasonable efforts to notify you of such a disclosure unless legally prohibited from doing so.

6.3 Business Transfers

In the event that gh888 undergoes a merger, acquisition, restructuring, or sale of all or a portion of its assets, your personal data may be transferred as part of that transaction. gh888 will notify affected players via email or an in-platform notification prior to any such transfer taking effect, and the receiving entity will be required to honour this Privacy Policy.

7. Payment Data and Financial Security

gh888 takes the security of payment data extremely seriously. The following principles govern how gh888 handles financial information:

• gh888 does not store full bKash or Nagad account PINs, full bank card numbers, CVV codes, internet banking usernames, or internet banking passwords on its servers at any time.
• Payment transactions are routed through encrypted, certified payment gateway integrations. The gateway handles sensitive authentication; gh888 receives only a transaction reference and a confirmation status.
• Partial payment identifiers (such as the last four digits of a card, or a masked mobile wallet number) are retained by gh888 solely to allow you to identify your registered payment methods and to facilitate withdrawal routing.
• All financial transaction records — including deposit amounts, withdrawal amounts, and bet settlements — are retained for a minimum of five years in accordance with applicable financial record-keeping obligations.
• gh888's payment processing infrastructure is subject to regular third-party security assessments to ensure compliance with current security standards.

8. Cookies and Tracking Technologies

gh888 uses cookies and similar technologies on its platform. A cookie is a small text file placed on your device by the gh888 website or app when you visit or log in. Cookies allow gh888 to recognise your browser on subsequent visits and maintain your session state.

8.1 Types of Cookies Used by gh888

8.2 Cookies gh888 Does Not Use

gh888 does not use third-party advertising cookies, retargeting cookies, social media tracking pixels, or cross-site behavioural profiling technologies of any kind. gh888 does not share cookie-derived data with advertising networks.

8.3 Managing Cookies

You may configure your browser to refuse all cookies or to alert you when a cookie is being set. However, disabling strictly necessary cookies will prevent you from logging into your gh888 account and using most platform features. gh888 recommends leaving strictly necessary and security cookies enabled at all times.

9. Data Retention

gh888 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active account data — retained for the full duration of your account being open and active on the gh888 platform.
• Financial and transaction records — retained for a minimum of five years following the relevant transaction date, in accordance with financial record-keeping obligations.
• Identity verification documents — retained for a minimum of five years following the closure of your account, as required for anti-money laundering compliance purposes.
• Support interaction records — retained for three years following the date of the interaction.
• Self-excluded player data — where a player has activated self-exclusion, sufficient data is retained for the duration of the self-exclusion period to prevent re-registration in circumvention of the exclusion.
• Anonymised analytics data — may be retained indefinitely in anonymised, aggregated form, as it no longer constitutes personal data once all identifying characteristics have been removed.

When the applicable retention period expires, gh888 securely deletes or irreversibly anonymises the relevant personal data. Deletion requests submitted by players are handled in accordance with the data rights process described in Section 11, subject to any overriding legal retention obligation.

10. Data Security

gh888 implements a layered set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption at rest: All personal data stored in gh888 databases is encrypted using AES-256 encryption.
• Encryption in transit: All data transmitted between your device and gh888 servers is protected by TLS 1.3 SSL encryption.
• Access controls: Access to personal data within gh888's systems is restricted to staff members who require it to perform their job function, enforced through role-based access controls and unique individual credentials.
• Two-factor authentication: All internal gh888 system access by staff is protected by mandatory two-factor authentication.
• Password security: Player passwords are stored as salted cryptographic hashes. gh888 never stores or transmits plain-text passwords.
• Security monitoring: gh888 maintains continuous monitoring of its platform infrastructure for anomalous activity, potential intrusion attempts, and data access irregularities.
• Regular security assessments: gh888 conducts periodic security reviews and engages independent professionals to assess the effectiveness of its security controls.

In the event of a data breach that is likely to result in a risk to the rights and freedoms of players, gh888 will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

11. Your Data Rights

As a gh888 player whose personal data is processed under this Privacy Policy, you have the following rights in respect of your personal data:

• Right of Access: You may request a copy of the personal data gh888 holds about you. gh888 will provide this within 30 days of receiving a valid request.
• Right to Rectification: If any personal data held by gh888 is inaccurate or incomplete, you have the right to request that it be corrected. Many data fields can be updated directly in your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data. gh888 will honour such requests unless retention is required to fulfil a legal obligation, such as the five-year financial record retention requirement.
• Right to Restriction: You may request that gh888 restrict the processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Data Portability: You may request that gh888 provide your personal data in a structured, commonly used, machine-readable format, suitable for transfer to another service provider.
• Right to Object: You may object to gh888's processing of your personal data where that processing is based on legitimate interest. You may also withdraw consent at any time where gh888 relies on consent as its legal basis.
• Right to Withdraw Marketing Consent: You may opt out of promotional communications at any time by updating your notification preferences in your account settings or by contacting support.

12. Children and Underage Users

The gh888 platform is strictly intended for individuals who are 21 years of age or older. gh888 does not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory step in the gh888 account registration process, and gh888 reserves the right to request documentary proof of age at any stage.

If gh888 becomes aware that personal data has been collected from an individual under 21, that account will be immediately suspended, all associated data will be deleted, and any deposited funds will be returned to the source payment method to the extent permitted by applicable law.

13. Third-Party Links and Game Providers

The gh888 platform integrates games from third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you launch a game from one of these providers, your session may be handled in part by that provider's own game client. Each game provider operates under its own privacy and security standards. gh888 requires all integrated game providers to maintain data protection standards that are consistent with this Privacy Policy.

gh888 is not responsible for the privacy practices of any third-party entity whose services are accessible via external links that may appear in promotional content or game descriptions. gh888 strongly recommends reviewing the privacy policy of any third-party service before submitting personal information to it.

14. Changes to This Privacy Policy

gh888 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the features of the gh888 platform. When material changes are made, gh888 will notify registered players via the email address associated with their account, or via an in-platform notification, at least 7 days before the revised policy takes effect.

The date of the most recent revision is displayed at the top of this page. Continued use of the gh888 platform following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with a material change to this Privacy Policy, you may close your account by contacting support prior to the effective date of the change.

15. Contact and Data Requests

For any questions, concerns, or formal requests relating to this Privacy Policy or gh888's data practices, please contact the gh888 data team using the details below:

When submitting a data rights request, please include your full name, your gh888 username, and a clear description of your request. Requests must be submitted from the email address registered to your gh888 account so that we can verify your identity before processing the request.